{"answers":{"affected":"4 open source packages ship an affected version, including flowise and flowise-components.","exploited":"There is no known exploitation of GHSA-j44m-5v8f-gc9c in the wild and no public exploit code.","fix":"Upgrade flowise to 3.0.8 or later.","what":"GHSA-j44m-5v8f-gc9c is a path traversal vulnerability in flowise, published on 10 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-j44m-5v8f-gc9c and fix it if it is affected.\n\nWhat it is: GHSA-j44m-5v8f-gc9c is a path traversal vulnerability in flowise, published on 10 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-j44m-5v8f-gc9c in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- flowise (npm): affected all versions; fixed in 3.0.8\n- flowise (npm): affected all versions; fixed in 3.0.8\n- flowise-components (npm): affected all versions; fixed in 3.0.8\n- flowise-components (npm): affected all versions; fixed in 3.0.8\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-j44m-5v8f-gc9c/ (Markdown: https://insights.sbomify.com/GHSA-j44m-5v8f-gc9c/index.md)","id":"GHSA-j44m-5v8f-gc9c","markdown":"https://insights.sbomify.com/GHSA-j44m-5v8f-gc9c/index.md","name":"GHSA-j44m-5v8f-gc9c","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["data_read","code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Flowise AI platform","requires_auth":"low_privilege","summary":"Authenticated attackers can read arbitrary files via the ReadFileTool, potentially leading to remote command execution.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\nThe ReadFileTool in Flowise does not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read arbitrary files from the file system, potentially leading to remote command execution.\n\n### Details\n\nFlowise supports providing ReadFileTool for large models to read files in the server's file system. The implementation of this tool is located at packages/components/nodes/tools/ReadFile/ReadFile.ts.\n\n```\n/**\n * Class for reading files from the disk. Extends the StructuredTool\n * class.\n */\nexport class ReadFileTool extends StructuredTool {\n    static lc_name() {\n        return 'ReadFileTool'\n    }\n\n    schema = z.object({\n        file_path: z.string().describe('name of file')\n    }) as any\n\n    name = 'read_file'\n\n    description = 'Read file from disk'\n\n    store: BaseFileStore\n\n    constructor({ store }: ReadFileParams) {\n        super(...arguments)\n\n        this.store = store\n    }\n\n    async _call({ file_path }: z.infer\u003ctypeof this.schema\u003e) {\n        return await this.store.readFile(file_path)\n    }\n}\n```\n\nThe tool directly uses the file_path parameter passed to it without verifying whether the path belongs to Flowise's working directory. Authenticated attackers can exploit this vulnerability to read any known file on the server. For example, if the victim deploys in a Docker environment, the attacker could attempt to read sensitive files such as /root/.flowise/encryption.key, /root/.flowise/database.sqlite, and obtain sensitive information. If the victim does not use a Docker environment for deployment, the attacker could try reading sensitive files like /etc/passwd, /etc/shadow, /root/.ssh/id_rsa, further achieving the effect of remote command execution.\n\n### PoC\n\nThis file reading vulnerability has been verified to exist in the latest Flowise Docker image (https://hub.docker.com/layers/flowiseai/flowise/latest/images/sha256-26300377397818a451e0710389eb77615256b0f3ecc895194850ab35dda3ae7b). The reproduction steps are as follows:\n\n1. Pull the Flowise Docker image\n\n```\ndocker pull flowiseai/flowise\n```\n\n2. Start the Flowise service\n\n```\ndocker run -d --name flowise -p 3000:3000 flowise\n```\n\n3. Access the Flowise service at server ip:3000 in the browser and register an account\n4. Save the following content as agent.json\n\n```\n{\n  \"nodes\": [\n    {\n      \"id\": \"startAgentflow_0\",\n      \"type\": \"agentFlow\",\n      \"position\": {\n        \"x\": -203,\n        \"y\": 37\n      },\n      \"data\": {\n        \"id\": \"startAgentflow_0\",\n        \"label\": \"Start\",\n        \"version\": 1.1,\n        \"name\": \"startAgentflow\",\n        \"type\": \"Start\",\n        \"color\": \"#7EE787\",\n        \"hideInput\": true,\n        \"baseClasses\": [\n          \"Start\"\n        ],\n        \"category\": \"Agent Flows\",\n        \"description\": \"Starting point of the agentflow\",\n        \"inputParams\": [\n          {\n            \"label\": \"Input Type\",\n            \"name\": \"startInputType\",\n            \"type\": \"options\",\n            \"options\": [\n              {\n                \"label\": \"Chat Input\",\n                \"name\": \"chatInput\",\n                \"description\": \"Start the conversation with chat input\"\n              },\n              {\n                \"label\": \"Form Input\",\n                \"name\": \"formInput\",\n                \"description\": \"Start the workflow with form inputs\"\n              }\n            ],\n            \"default\": \"chatInput\",\n            \"id\": \"startAgentflow_0-input-startInputType-options\",\n            \"display\": true\n          },\n          {\n            \"label\": \"Form Title\",\n            \"name\": \"formTitle\",\n            \"type\": \"string\",\n            \"placeholder\": \"Please Fill Out The Form\",\n            \"show\": {\n              \"startInputType\": \"formInput\"\n            },\n            \"id\": \"startAgentflow_0-input-formTitle-string\",\n            \"display\": false\n          },\n          {\n            \"label\": \"Form Description\",\n            \"name\": \"formDescription\",\n            \"type\": \"string\",\n            \"placeholder\": \"Complete all fields below to continue\",\n            \"show\": {\n              \"startInputType\": \"formInput\"\n            },\n            \"id\": \"startAgentflow_0-input-formDescription-string\",\n            \"display\": false\n          },\n          {\n            \"label\": \"Form Input Types\",\n            \"name\": \"formInputTypes\",\n            \"description\": \"Specify the type of form input\",\n            \"type\": \"array\",\n            \"show\": {\n              \"startInputType\": \"formInput\"\n            },\n            \"array\": [\n              {\n                \"label\": \"Type\",\n                \"name\": \"type\",\n                \"type\": \"options\",\n                \"options\": [\n                  {\n                    \"label\": \"String\",\n                    \"name\": \"string\"\n                  },\n                  {\n                    \"label\": \"Number\",\n                    \"name\": \"number\"\n                  },\n                  {\n                    \"label\": \"Boolean\",\n                    \"name\": \"boolean\"\n                  },\n                  {\n                    \"label\": \"Options\",\n                    \"name\": \"options\"\n                  }\n                ],\n                \"default\": \"string\"\n              },\n              {\n                \"label\": \"Label\",\n                \"name\": \"label\",\n                \"type\": \"string\",\n                \"placeholder\": \"Label for the input\"\n              },\n              {\n                \"label\": \"Variable Name\",\n                \"name\": \"name\",\n                \"type\": \"string\",\n                \"placeholder\": \"Variable name for the input (must be camel case)\",\n                \"description\": \"Variable name must be camel case. For example: firstName, lastName, etc.\"\n              },\n              {\n                \"label\": \"Add Options\",\n                \"name\": \"addOptions\",\n                \"type\": \"array\",\n                \"show\": {\n                  \"formInputTypes[$index].type\": \"options\"\n                },\n                \"array\": [\n                  {\n                    \"label\": \"Option\",\n                    \"name\": \"option\",\n                    \"type\": \"string\"\n                  }\n                ]\n              }\n            ],\n            \"id\": \"startAgentflow_0-input-formInputTypes-array\",\n            \"display\": false\n          },\n          {\n            \"label\": \"Ephemeral Memory\",\n            \"name\": \"startEphemeralMemory\",\n            \"type\": \"boolean\",\n            \"description\": \"Start fresh for every execution without past chat history\",\n            \"optional\": true,\n            \"id\": \"startAgentflow_0-input-startEphemeralMemory-boolean\",\n            \"display\": true\n          },\n          {\n            \"label\": \"Flow State\",\n            \"name\": \"startState\",\n            \"description\": \"Runtime state during the execution of the workflow\",\n            \"type\": \"array\",\n            \"optional\": true,\n            \"array\": [\n              {\n                \"label\": \"Key\",\n                \"name\": \"key\",\n                \"type\": \"string\",\n                \"placeholder\": \"Foo\"\n              },\n              {\n                \"label\": \"Value\",\n                \"name\": \"value\",\n                \"type\": \"string\",\n                \"placeholder\": \"Bar\",\n                \"optional\": true\n              }\n            ],\n            \"id\": \"startAgentflow_0-input-startState-array\",\n            \"display\": true\n          },\n          {\n            \"label\": \"Persist State\",\n            \"name\": \"startPersistState\",\n            \"type\": \"boolean\",\n            \"description\": \"Persist the state in the same session\",\n            \"optional\": true,\n            \"id\": \"startAgentflow_0-input-startPersistState-boolean\",\n            \"display\": true\n          }\n        ],\n        \"inputAnchors\": [],\n        \"inputs\": {\n          \"startInputType\": \"chatInput\",\n          \"formTitle\": \"\",\n          \"formDescription\": \"\",\n          \"formInputTypes\": \"\",\n          \"startEphemeralMemory\": \"\",\n          \"startState\": \"\",\n          \"startPersistState","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Flowise is vulnerable to arbitrary file exposure through its ReadFileTool","id":"GHSA-j44m-5v8f-gc9c","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"path_traversal","year":"2025"},"n_packages":4,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["3.0.8"],"introduced":["0"],"last_affected":[],"package":"flowise","purl":null,"source":"GHSA-j44m-5v8f-gc9c"},{"ecosystem":"npm","fixed":["3.0.8"],"introduced":["0"],"last_affected":[],"package":"flowise","purl":"pkg:npm/flowise","source":"GHSA-j44m-5v8f-gc9c"},{"ecosystem":"npm","fixed":["3.0.8"],"introduced":["0"],"last_affected":[],"package":"flowise-components","purl":null,"source":"GHSA-j44m-5v8f-gc9c"},{"ecosystem":"npm","fixed":["3.0.8"],"introduced":["0"],"last_affected":[],"package":"flowise-components","purl":"pkg:npm/flowise-components","source":"GHSA-j44m-5v8f-gc9c"}],"products":null,"published":"2025-10-10","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Authenticated attackers can read arbitrary files via the ReadFileTool, potentially leading to remote command execution.","url":"https://insights.sbomify.com/GHSA-j44m-5v8f-gc9c/"}