CVE-2026-91934: Flowise before 3.1.4 Remote Code Execution via SQL Database Chain

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-15 · updated 2026-09-16
Weakness: CWE-22

Description

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execute commands or perform stored XSS attacks.

Affected products

FlowiseAI Flowise: before 3.1.4 — fixed in 3.1.4

How to fix

Upgrade to a fixed version: FlowiseAI Flowise 3.1.4. Check the vendor advisory for mitigations.

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-pwfj-wh95-7mwp
https://www.vulncheck.com/advisories/flowise-before-3.1.4-remote-code-execution-via-sql-database-chain

Get alerted when CVE-2026-91934 or the next vulnerability affects your stack