CVE-2024-9148: Flowiseai Embed Stored XSS Vulnerability

CVE-2024-9148 Overview

CVE-2024-9148 is a Stored Cross-Site Scripting (XSS) vulnerability affecting Flowise versions prior to 2.1.1. The flaw originates in the Flowise Chat Embed component before version 2.0.0, which fails to sanitize user-supplied input before rendering it in the chat interface. An attacker can inject persistent JavaScript payloads that execute in the browser context of any user who loads the affected chat widget. Flowise is a low-code platform for building large language model (LLM) applications, and the embed component is commonly deployed on public-facing websites. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in victim browsers, enabling session theft, credential harvesting, and unauthorized actions against the Flowise application.

Affected Products

Flowise (flowiseai/flowise) versions prior to 2.1.1
Flowise Chat Embed (flowiseai/embed) versions prior to 2.0.0
Deployments exposing the embedded chat widget to untrusted input

Discovery Timeline

2024-09-25 - CVE-2024-9148 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9148

Vulnerability Analysis

The vulnerability resides in the Flowise Chat Embed component, which renders chat content without applying output encoding or input sanitization. Attacker-controlled strings containing HTML or JavaScript are stored by the backend and later returned to any user rendering the widget. When the browser parses the response, the injected markup executes in the origin context of the hosting page.

Because the payload is stored server-side, exploitation does not require repeated attacker interaction. Every subsequent visitor to the affected chat interface triggers the payload. The scope-changed impact reflects the fact that scripts can reach content and cookies belonging to the parent page embedding the widget.

Root Cause

The root cause is missing input validation and output encoding in the chat rendering pipeline of flowiseai/embed. User-supplied message content is passed through to the DOM without escaping HTML entities or stripping active content such as <script> tags, event handlers (onerror, onload), or javascript: URIs.

Attack Vector

Exploitation is network-based and requires user interaction, specifically loading a page that renders the vulnerable embed. An attacker submits a crafted chat message containing an XSS payload. The Flowise backend persists the message, and it is delivered to subsequent viewers of the chat widget. Executed script runs with the privileges of the victim's session, enabling theft of authentication tokens, arbitrary requests to the Flowise API, and defacement of the embedding page.

No verified public proof-of-concept code is available. Refer to the Tenable Security Research Analysis for technical detail from the reporting party.

Detection Methods for CVE-2024-9148

Indicators of Compromise

Chat messages or stored records in the Flowise database containing <script>, onerror=, onload=, or javascript: substrings
Outbound requests from user browsers to unknown domains shortly after loading a page hosting the Flowise embed
Unexpected document.cookie or localStorage access originating from the embed iframe or container

Detection Strategies

Inspect Flowise chat storage for HTML tags and JavaScript event attributes within message fields
Deploy a Content Security Policy (CSP) in report-only mode on pages embedding the widget and review violation reports for injected inline scripts
Correlate web server access logs for POST requests to chat endpoints that contain encoded XSS signatures such as %3Cscript%3E or %3Cimg%20

Monitoring Recommendations

Alert on new outbound domains contacted from pages hosting Flowise Chat Embed
Monitor Flowise application logs for anomalous message payload sizes and repeated messages containing HTML markup
Track browser console errors and CSP violation reports centrally for pages that embed the widget

How to Mitigate CVE-2024-9148

Immediate Actions Required

Upgrade Flowise to version 2.1.1 or later and Flowise Chat Embed to version 2.0.0 or later
Audit stored chat history and purge any messages containing script tags or JavaScript event handlers
Rotate API keys and session credentials that may have been exposed through the embedded widget

Patch Information

Upgrade flowiseai/flowise to >= 2.1.1 and flowiseai/embed to >= 2.0.0. Both packages must be updated together because the vulnerability is triggered by the embed component consuming data served by the Flowise backend. Consult the Tenable Security Research Analysis for the vendor-confirmed fixed versions.

Workarounds

Restrict access to the Flowise chat interface to authenticated internal users until patching is complete
Deploy a strict Content Security Policy that disallows inline scripts (script-src 'self') on pages hosting the embed
Place the embed inside a sandboxed iframe with the sandbox attribute to limit script capabilities against the parent origin
Apply a web application firewall (WAF) rule to strip HTML tags from chat message POST bodies as an interim control

bash

# Configuration example: upgrade Flowise and the embed component
npm install flowise@^2.1.1
npm install flowise-embed@^2.0.0

# Example strict CSP header for pages embedding the widget
# Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'