Goal Reached Thanks to every supporter β€” we hit 100%!

Goal: 1000 CNY Β· Raised: 1000 CNY

100.0%

CVE-2025-59434 β€” AI Deep Analysis Summary

CVSS 9.6 Β· Critical

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Flowise has an **Access Control Error** in its Custom JavaScript Function nodes.…

Q2Root Cause? (CWE/Flaw)

πŸ›‘οΈ **Root Cause**: **CWE-200** (Information Exposure). <br>πŸ” **Flaw**: Improper access control logic within the **Custom JavaScript Function** node implementation fails to restrict data visibility correctly.

Q3Who is affected? (Versions/Components)

πŸ‘₯ **Affected**: Users running **Flowise** (the open-source LLM app builder by FlowiseAI). <br>πŸ“¦ **Component**: Specifically the **Custom JavaScript Function** node functionality.

Q4What can hackers do? (Privileges/Data)

πŸ’€ **Attacker Actions**: Hackers can bypass isolation boundaries.…

Q5Is exploitation threshold high? (Auth/Config)

πŸ”‘ **Threshold**: **Medium**. <br>πŸ“ **Requirements**: Requires **Low Privileges** (PR:L) and **Low Complexity** (AC:L). No user interaction needed (UI:N). Network accessible (AV:N).

Q6Is there a public Exp? (PoC/Wild Exploitation)

🚫 **Public Exp?**: **No**. <br>πŸ“„ **Status**: The `pocs` field is empty. No public Proof-of-Concept or wild exploitation code is currently available.

Q7How to self-check? (Features/Scanning)

πŸ” **Self-Check**: Scan for instances of Flowise using the **Custom JavaScript Function** node.…

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Fix Status**: **Yes**. <br>πŸ”— **Reference**: Official advisory available at [GitHub Advisory GHSA-435c-mg9p-fv22](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-435c-mg9p-fv22).…

Q9What if no patch? (Workaround)

πŸ›‘οΈ **Workaround**: If unpatched, **disable** or **restrict** the use of Custom JavaScript Function nodes.…

Q10Is it urgent? (Priority Suggestion)

πŸ”₯ **Urgency**: **High**. <br>πŸ“… **Priority**: CVSS Score indicates **High** severity (C:H, I:H). Given the cross-tenant nature, immediate patching or mitigation is critical to prevent data breaches.