CVE-2025-71331: Flowise XSS Vulnerability in Chat Messages and Agent Functions

Technical summary

CVE-2025-71331 is a stored/reflected XSS vulnerability (CWE-80) affecting Flowise chat and custom agent function handling. The vulnerability stems from insufficient input validation and output encoding. Attackers can craft payloads such as iframe elements with JavaScript handlers or supply malicious content from external sources through agent function returns. When a user views the chat or agent response, the unfiltered payload executes in the browser context, bypassing same-origin protections via the CCSS:C parameter. The CVSS 3.1 score of 6.1 reflects network accessibility, low attack complexity, no privilege requirements, but limited impact scope to confidentiality and integrity without denial of service.

Business impact

Organizations running Flowise-based chat applications face credential compromise risk and data exfiltration. If users interact with chat instances containing injected payloads, attackers gain access to session tokens, authentication cookies, and potentially personal information displayed in the chat interface or accessible via the user's browser session. For SaaS deployments or enterprises using Flowise internally, this enables account takeover and lateral movement. Customer-facing deployments risk reputation damage and regulatory exposure if user data is stolen. The medium CVSS score should not understate the practical impact: XSS targeting authentication credentials is frequently weaponized.

Affected systems

Flowise versions prior to 3.0.8 are affected. The vulnerability is present in the chat message input handler and custom agent function output processor. Any deployment or instance running unpatched Flowise—whether self-hosted, containerized, or integrated into a larger platform—is vulnerable if it accepts user input or fetches content from external sources via agent functions.

Exploitability

Exploitation requires user interaction (phishing, social engineering, or direct platform access) but no authentication or special privileges. An attacker sends a malicious chat message or configures a custom agent to return an XSS payload. The barrier to exploitation is low: simple iframe or script injection syntax works. Public disclosure increases risk; we do not track active KEV status at this time, but the simplicity of payload construction suggests rapid weaponization is possible if not already occurring.

Remediation

Upgrade Flowise to version 3.0.8 or later immediately. Verify the upgrade includes input sanitization and output encoding fixes for both chat message processing and custom agent function returns. Organizations unable to upgrade immediately should restrict Flowise to authenticated internal users only and disable custom agent functions that fetch external content until patching is complete.

Patch guidance

Flowise maintainers recommend upgrading to 3.0.8 or later. Review your current version via the Flowise admin interface or version command. For containerized deployments, update the container image tag and redeploy. For npm-based installations, run 'npm install flowise@latest' (or a specific patched version). Test in a staging environment before production rollout. Verify that chat and agent functions no longer render unencoded HTML or execute injected scripts post-upgrade. If you maintain custom agent functions, audit them for external content fetching and implement server-side sanitization as defense-in-depth.

Detection guidance

Monitor Flowise application logs for chat messages or agent function outputs containing suspicious payloads (iframe, script, event handlers, javascript: protocols). Implement Content Security Policy (CSP) headers at the Flowise application level to restrict script execution. Use browser developer tools or network inspection to verify that responses from Flowise API endpoints are properly encoded (HTML entities, not raw HTML). Conduct user awareness training: educate users not to click or copy-paste links from untrusted chat sources. Consider WAF rules to block common XSS patterns in request bodies sent to Flowise endpoints.

Why prioritize this

Although CVSS 6.1 is medium severity, XSS vulnerabilities targeting authentication credentials warrant rapid patching in any customer-facing or internal collaboration tool. Flowise often processes sensitive conversational data and user interactions; compromised sessions leak that context. The low exploitation barrier and user-interaction requirement make this a social engineering vector. Prioritize patching within 1–2 weeks, especially if Flowise is exposed to external users or processes PII.

Risk score, explained

CVSS 3.1 score of 6.1 reflects: network-accessible attack surface (AV:N), no special attack conditions (AC:L), no authentication required (PR:N), and user interaction necessary (UI:R). Impact is limited to confidentiality and integrity (C:L/I:L) with no availability impact (A:N). Scope is changed (S:C), meaning the vulnerability can affect resources beyond the vulnerable component. The score does not fully capture business risk of session hijacking or the likelihood of social engineering exploitation; it serves as a baseline for technical triage, not business priority.

Frequently asked questions