CVE-2025-71331

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.8

Description Insufficient input filtering in chat messages and custom agent functions allows for cross-site scripting (XSS), a flaw where malicious scripts are injected into trusted websites. An attacker can execute malicious JavaScript in a victim's browser by sending an iframe payload, such as <iframe src="javascript:alert(document.cookie)">, through a chat box or by configuring a custom agent function to return a payload from an external website. This can lead to the theft of session data and cookies.

Recommendations Update to version 3.0.8.