Detections
Analytics

SCA: security update for flowise (GHSA-8r8h-6vcc-xhrv)

high Tenable Cloud Security Plugin ID 445637

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior
 to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view,
 bypassing the permission-protected Variables API. Variables for the active workspace are fetched at
 packages/components/src/utils.ts and runtime variables are resolved from server environment variables,
 while the official variables route enforces variables:view. A user or API key that is denied
 variables:view can call /api/v1/node-custom-function and receive $vars pre-populated with all variables
 for the workspace, including Variable.name to Variable.value static variables and Variable.name to
 process.env[Variable.name] runtime variables. This can expose secrets such as database passwords, JWT
 secrets, SMTP passwords, and cloud keys, depending on the workspace Variables configuration. This issue is
 fixed in version 3.1.3. (CVE-2026-70471)

Solution

Update the flowise library and its related packages to version 3.1.3 or later.

See Also

https://github.com/advisories/GHSA-8r8h-6vcc-xhrv

Plugin Details

Severity: High

ID: 445637

Version: Revision 1.2

Type: Local

Family: SCA Checks

Published: 8/4/2026

Updated: 8/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.75

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2026-70471

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.1

Threat Score: 4.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/4/2026

Vulnerability Publication Date: 8/4/2026

Reference Information

CVE: CVE-2026-70471

cwe: CWE-863