CVE-2025-55346
CVE-2025-55346 · Unintended dynamic code execution leads to remote code execution by network attackers
This page contains facts from public vulnerability sources. Check the original advisory before updating.
User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request.
CVSS 9.8 · Critical · EPSS 22.4%
- Published
- Updated
Stack: node
Affected products and versions
flowise npm
- Affected ranges
- SEMVER: ≤ 2.2.7-patch.1
No fix published