flowise@3.0.6
Skip this version — install 3.1.4 instead.
Followed by 3.0.7 within 5 h — likely a hotfix.
Why this verdict
- Followed by 3.0.7 within 5 h — likely a hotfix.Evidence
- 87 known advisories (worst: critical), fixed in 3.1.4.Evidence
Confidence 100% · algorithm v1 · computed 2026-11-04. How verdicts work
Supply chain and security
- Malware reports
- None known (OSV)
- Known advisories
- 87 known
- License
- non-standard
- Install scripts
- None
- Build provenance
- No provenance
- Weekly downloads
- 125
- GHSA-2364-jh4q-m9vmFlowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint
- GHSA-28g4-38q8-3cwcFlowise: Cypher Injection in GraphCypherQAChain
- GHSA-2qqc-p94c-hxwhFlowise: Weak Default Express Session Secret
- GHSA-2x8m-83vc-6wv4Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
- GHSA-3769-jgqc-cxm7Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
- GHSA-3hjv-c53m-58jjFlowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
- GHSA-3prp-9gf7-4rxxFlowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)
- GHSA-48m6-ch88-55mjFlowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association
- GHSA-4fr9-3x69-36wvFlowise vulnerable to XSS
- GHSA-4j8x-x6v7-w9rqFlowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
Compatibility
No compatibility boundary is crossed: this is a patch or minor release on a stable major.
Check the official release notes below for behaviour changes before merging.
Release notes
Read the package page on npm for this version’s features and fixes.
Deprecations and deadlines
The maintainer has not deprecated this version on npm.