Detections
Analytics
SCA: security update for flowise (GHSA-c6xh-wv4j-ppv5)
high Tenable Cloud Security Plugin ID 445622
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3,
Flowise's HTTP security module httpSecurity.ts did not normalize IPv4-mapped IPv6 addresses such as
::ffff:127.0.0.1 and ::ffff:169.254.169.254 before checking them against the deny list. Because ipaddr.js
reports these addresses as ipv6 while IPv4 CIDR deny-list entries are ipv4, isDeniedIP() skipped the IPv4
CIDR checks. An attacker who controls DNS resolution for a hostname used by the HTTP Node, API Chain,
Document Loader, MCP tool, or other paths using secureAxiosRequest(), secureFetch(), or checkDenyList()
could return a AAAA record for an IPv4-mapped target and cause requests to reach localhost, internal
services, or cloud metadata endpoints. This issue is fixed in version 3.1.3. (CVE-2026-69257)
Solution
Update the flowise library and its related packages to version 3.1.3 or later.See Also
Plugin Details
Severity: High
ID: 445622
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 8/4/2026
Updated: 8/4/2026
Risk Information
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2026-69257
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 7.6
Threat Score: 5
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 8/4/2026
Vulnerability Publication Date: 8/4/2026
Reference Information
CVE: CVE-2026-69257