CVE-2026-91938

HIGHCVSS 7.1

Description

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response content returned as document text.

Timeline

Published:September 15th, 2026 4:17 PM

Last modified:September 16th, 2026 8:15 PM

CVSS Scoring

CVSS v3: 7.1 (HIGH)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Weaknesses (CWE)

CWE-918

References & Reports

Advisories, patches, and third-party reports

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9cvr-5wv9-2gxr
https://www.vulncheck.com/advisories/flowise-before-3.1.4-server-side-request-forgery-via-document-loaders

Source: NIST NVD · Data may lag official sources by up to one minute