A stored Cross-site Scripting vulnerability in Flowise allows unauthenticated attackers to execute malicious scripts in an administrator's browser session, potentially leading to unauthorized actions.

The application fails to properly neutralize user-supplied input within FORM and INPUT elements, allowing an attacker to inject malicious scripts that execute when an administrator views the chat logs. This flaw is classified as CWE-79 and requires no authentication to trigger the initial injection.

The successful exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of the Flowise administrative interface. By compromising an administrator session, an attacker could potentially gain unauthorized access to sensitive data, modify system configurations, or perform actions on behalf of the administrator. With a CVSS score of 8.2, this vulnerability is categorized as High severity due to the potential for administrative account takeover.

Immediate Action: Update the Flowise installation to version 3.0.5 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Review administrative access logs and monitor for unusual activity, particularly within the chat log management modules, to identify potential exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common XSS payloads, particularly those targeting FORM and INPUT parameters.

Public Exploit Available: Unknown.

Given the High severity of this vulnerability and the existence of a proof-of-concept, organizations using Flowise should prioritize the update to version 3.0.5 immediately. Failure to patch allows for a clear path to session hijacking and administrative compromise. Please ensure all instances are verified against the fixed version to eliminate this risk.