PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-58351 Flowise CVE debrief

CVE-2024-58351 is a critical vulnerability in Flowise, a platform that allows configuration to be injected into the Chainflow during execution via the overrideConfig option. This feature, enabled by default with no allow-list of permitted variables, relies on vm2 for sandboxing. An attacker can exploit this to achieve remote code execution, denial of service, server-side request forgery, prompt injection, and data exfiltration. These issues are self-targeted and do not persist to other users. The CVSS score is 9.3, indicating a critical severity. Defenders should prioritize patching Flowise installations to version 2.1.4 or later to mitigate these risks.

Vendor
Flowise
Product
Unknown
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-20
Original CVE updated
2026-06-22
Advisory published
2026-06-20
Advisory updated
2026-06-22

Who should care

Organizations using Flowise before version 2.1.4 should prioritize patching to prevent potential remote code execution, denial of service, and data exfiltration attacks. Security teams and administrators responsible for maintaining Flowise installations are urged to review and update their systems accordingly.

Technical summary

The vulnerability exists in Flowise's overrideConfig option, which allows configuration injection into the Chainflow during execution. This feature is enabled by default and lacks an allow-list of permitted variables. Relying on vm2 for sandboxing, an attacker can exploit this to achieve remote code execution and sandbox escape, denial of service by crashing the server, server-side request forgery, prompt injection, and server variable and data exfiltration. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X, indicating a critical severity with a score of 9.3.

Defensive priority

Critical due to remote code execution and high impact potential

Recommended defensive actions

  • Update Flowise to version 2.1.4 or later
  • Review and restrict the use of overrideConfig option
  • Implement additional monitoring for suspicious Chainflow executions
  • Conduct a thorough inventory of Flowise installations
  • Verify the integrity of Chainflow configurations

Evidence notes

The primary evidence for this vulnerability comes from the CVE record and details provided by Vulncheck. The affected product is Flowise, with versions before 2.1.4 being vulnerable. The evidence limits are based on the information available up to the publication date. Defenders should verify the official CVE record and vendor advisories for the most current information.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-58351 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-58351

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-58351 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-58351

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.