Skip to content

CVE-2025-50538

CVE-2025-50538

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.

CVSS 8.2 · High · EPSS 14.0% · Fix available

Published: 2025-10-06T00:00:00.000Z
Updated: 2025-10-06T13:53:37.852Z

Stack: node

Affected products and versions

flowise
Versions
- ≥ 0, < 3.0.5: Affected (semver)
Update to 3.0.5
flowise npm
Affected ranges
- SEMVER: < 3.0.8
Update to 3.0.8

Original sources

Check your server →