{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.0.13"
      },
      "package": {
        "ecosystem": "npm",
        "name": "flowise"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.0.13"
      },
      "package": {
        "ecosystem": "npm",
        "name": "flowise-components"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-16T21:23:03Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nFlowise introduced SSRF protections through a centralized HTTP security wrapper (`httpSecurity.ts`) that implements deny-list validation and IP pinning logic.\n\nHowever, multiple tool implementations directly import and invoke raw HTTP clients (`node-fetch`, `axios`Instead of using the secured wrapper.\n\nBecause enforcement is neither mandatory nor centralized, these tools bypass SSRF mitigation entirely, restoring full SSRF capability even after the patch.\n\nThis issue is distinct from specification trust issues and represents incomplete mitigation of previously addressed SSRF vulnerabilities.\n\n### Details\n**Intended Security Model:**\n\nAll outbound HTTP requests should pass through the centralized validation layer implemented in:\n\n```\npackages/components/src/httpSecurity.ts\n```\n\nThis layer performs:\n\n- `HTTP_DENY_LIST` enforcement\n- IP resolution validation\n- IP pinning\n- Loopback blocking\n\n**Observed Implementation Gap:**\n\nMultiple tools bypass this layer and import HTTP libraries directly.\n\nExamples include:\n\n- `packages/components/nodes/tools/OpenAPIToolkit/OpenAPIToolkit.ts`\n- `packages/components/nodes/tools/WebScraperTool/WebScraperTool.ts`\n- `packages/components/nodes/tools/MCP/core.ts`\n- `packages/components/nodes/tools/Arxiv/core.ts`\n\nThese files directly execute:\n\n```\nimportfetchfrom\u0027node-fetch\u0027\n```\n\nor invoke `axios` without passing through the centralized validation wrapper.\n\nBecause there is no global interceptor or enforcement mechanism, outbound requests in these components are executed without SSRF validation.\n\nThis renders the mitigation introduced in GHSA-2x8m-83vc-6wv4 incomplete.\n\n### Root Cause\n\nSecurity enforcement is not centralized.\n\nOutbound request validation depends on voluntary usage of a wrapper function rather than being structurally enforced.\n\nBecause direct imports of HTTP clients are allowed, the mitigation is easily bypassed.\n\nThis is an architectural enforcement failure rather than a single implementation bug.\n\n### PoC\nEven when an administrator configures:\n\n```\nHTTP_DENY_LIST=169.254.0.0/16,127.0.0.0/8\n```\n\nThe following attack succeeds if a vulnerable tool is enabled:\n\n**Chat Prompt:**\n\n```\nUse the Web Scraper tool to retrieve:\nhttp://169.254.169.254/latest/meta-data/iam/security-credentials/\n```\n\nExecution flow:\n\n1. The LLM triggers `WebScraperTool`.\n2. The tool calls raw `fetch()` directly.\n3. No `httpSecurity.ts` validation is applied.\n4. The request reaches the metadata endpoint.\n5. The response is returned to the chat context.\n\nThis demonstrates that SSRF protection is opt-in rather than enforced.\n### Impact\n\n**Severity:** Critical (CVSS v3.1: 9.1 \u2013 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nThis issue:\n\n- Completely bypasses the centralized SSRF mitigation.\n- Allows access to internal network resources.\n- Enables the exploitation of cloud metadata and credential theft.\n- Invalidates the security assumptions of the recent patch.\n\nAny deployment enabling affected tools remains vulnerable.\n\n### Recommended Remediation\n\n1. Refactor all tools to use the centralized `secureFetch()` wrapper.\n2. Add ESLint `no-restricted-imports` rules to prohibit the direct usage of `node-fetch` or `axios` in tool components.\n3. Consider implementing a single internal HTTP client abstraction layer.\n4. Apply network-level egress filtering as defense-in-depth.",
  "id": "GHSA-qqvm-66q4-vf5c",
  "modified": "2026-04-16T21:23:03Z",
  "published": "2026-04-16T21:23:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FlowiseAI/Flowise"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)"
}