A critical code injection vulnerability in Flowise allows unauthenticated remote attackers to execute arbitrary code, posing a severe risk of full system compromise.

This vulnerability is a Code Injection (CWE-94) flaw resulting from the use of unsafe dynamic Function constructors to process user-controlled input. It allows unauthenticated network-based attackers to execute arbitrary JavaScript in the host environment.

The CVSS score of 9.8 reflects the extreme severity of this flaw, as it allows for trivial, unauthenticated remote code execution. Successful exploitation can lead to total system compromise, theft of sensitive data, and unauthorized persistence within the infrastructure, representing a catastrophic risk to organizational security.

Immediate Action: As no specific patch version is currently identified, verify if your deployment is exposed to external networks and consider restricting access until a vendor-supplied update is available.

Proactive Monitoring: Monitor server logs and application telemetry for unusual JavaScript execution patterns or unauthorized requests directed at input-processing endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block suspicious payloads containing JavaScript execution patterns targeting dynamic function constructors.

Public Exploit Available: Unknown

Given the critical CVSS score and the existence of a proof-of-concept, immediate defensive action is required. Organizations should isolate affected instances from the public internet and prioritize the application of any forthcoming vendor updates to eliminate this high-risk injection vector.