Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-14 | 1 | Disclosure1 |
| 2026-05-31 | 1 | PoC1 |
CVE-2024-31621 hits the file upload parser. Attackers craft malicious JSON files that execute arbitrary code during import. Flowise has 20k+ GitHub stars, likely thousands of deployments. Exploit PoCs are already circulating. How many orgs even know they're running this?
Post summary
CVE-2024-31621 enables arbitrary code execution through malicious JSON imports in the Flowise file upload parser, and PoC exploits are already circulating.
🔴 #Flowise, Mass Assignment, #CVE-2024-31621 (High) https://dailycve.com/flowise-mass-assignment-cve-2024-31621-high/
Post summary
The post announces CVE-2024-31621 for Flowise, describing it as a high‑severity mass‑assignment flaw, but provides no further details on PoC, exploitation, or remediation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | flowiseai | flowise | - | - | - |