Quitbug

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 3.0.8 **Description** Insufficient input filtering in chat messages and custom agent functions allows for cross-site scripting (XSS), a flaw where malicious scripts are injected into trusted websites. An attacker can execute malicious JavaScript in a victim's browser by sending an iframe payload, such as `<iframe src="javascript:alert(document.cookie)">`, through a chat box or by configuring a custom agent function to return a payload from an external website. This can lead to the theft of session data and cookies. **Recommendations** Update to version 3.0.8.