CVE-2024-31621: Flowise api/v1 code injection allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityHigh CVSS (7.6), public exploit code, and very high EPSS (99th percentile) make this a likely target despite no KEV listing.

What it is

Flowise v1.6.2 and earlier contains a code injection flaw (CWE-94) in the api/v1 component. A remote attacker can supply a crafted script that leads to arbitrary code execution. Because Flowise is a low-code LLM orchestration tool often exposed to internal networks, successful exploitation can compromise the host running it.

Impact

An attacker gains arbitrary code execution in the context of the Flowise service, allowing data theft, lateral movement, or full host compromise. The CVSS vector rates integrity impact as High with limited confidentiality and availability impact.

Attack surface

Reached over the network via the api/v1 endpoint (AV:N). The CVSS vector requires low privileges (PR:L) and no user interaction (UI:N), so an authenticated low-privilege user or API client is sufficient.

Exploitation

A public Exploit-DB entry (52001) exists, and EPSS is 0.59867 (99th percentile), indicating high likelihood of exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild activity is documented in this record.

What to do

• Upgrade Flowise to a version later than 1.6.2; the record does not specify the exact fixed version, so confirm with the vendor.
• Restrict network access to the api/v1 endpoint to trusted hosts and require strong authentication.
• Run Flowise with least privilege and isolate it from sensitive internal networks or data.
• Monitor and restrict the ability to submit or execute custom scripts through the API.

Detection

• Inspect Flowise api/v1 request logs for unusual or script-like payloads.
• Alert on unexpected child processes spawned by the Flowise service (e.g., shells, interpreters).
• Monitor for outbound connections from the Flowise host to unknown destinations.
• Review authentication logs for low-privilege accounts accessing api/v1 endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.