A Cross-site Scripting vulnerability in Flowise allows unauthenticated attackers to execute malicious scripts in the context of an administrator session, posing a significant risk to platform integrity.

This vulnerability is a Cross-site Scripting (CWE-79) flaw that allows an attacker to inject malicious IFRAME elements into the chat log. When an administrator views these logs, the injected script executes within their authenticated browser session.

Successful exploitation of this vulnerability can lead to unauthorized access to administrative sessions, potential data theft, and the compromise of sensitive credentials or platform configurations. With a CVSS score of 8.2, this issue is classified as High severity, reflecting the significant risk of session hijacking and unauthorized administrative actions within the application.

Immediate Action: Update the Flowise installation to version 3.0.8 or later to resolve the underlying vulnerability.

Proactive Monitoring: Monitor administrative access logs for unusual IFRAME activity or unexpected redirects when accessing the chat history interface.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the loading of unauthorized IFRAME sources and utilize a Web Application Firewall (WAF) to filter suspicious script injection patterns.

Public Exploit Available: Unknown.

Given the High severity rating and the identified proof-of-concept risk, organizations running Flowise should prioritize applying the provided security update immediately. Administrators must ensure that their instances are patched to version 3.0.8 to prevent potential session compromise and ensure the security of the administrative environment.