CVE-2025-29192 - Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log

HIGH

Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log

Published Oct 6, 2025

8.2

HIGH

CVSS 3.1

EPSS 0.41%

Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
FlowiseAI	Flowise	unaffected	Affected ≥ 0, < 3.0.5

Ecosystem	Package	Introduced	Fixed
npm	flowise	0	3.0.5

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-32213		Advisory
https://github.com/FlowiseAI/Flowise/commit/9a06a85a8ddcbaeca1342827a5fea9087a587d97
https://github.com/FlowiseAI/Flowise/pull/4905		Patch
https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.5		Release Notes
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-7r4h-vmj9-wg42		exploitThird Party Advisory
https://github.com/advisories/GHSA-7r4h-vmj9-wg42		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-29192