{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-59434", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-15T19:13:16.906Z", "datePublished": "2025-09-22T19:39:03.774Z", "dateUpdated": "2025-09-22T19:47:56.540Z"}, "containers": {"cna": {"title": "Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-435c-mg9p-fv22", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-435c-mg9p-fv22"}], "affected": [{"vendor": "FlowiseAI", "product": "Flowise", "versions": [{"version": "< cloud-hosted (as of Aug 2025)", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-22T19:39:03.774Z"}, "descriptions": [{"lang": "en", "value": "Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive environment variables from other tenants via the Custom JavaScript Function node. This includes secrets such as OpenAI API keys, AWS credentials, Supabase tokens, and Google Cloud secrets \u2014 resulting in a full cross-tenant data exposure. This issue has been patched in the August 2025 Cloud-Hosted Flowise."}], "source": {"advisory": "GHSA-435c-mg9p-fv22", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-22T19:47:22.934320Z", "id": "CVE-2025-59434", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-22T19:47:56.540Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59434", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-22T19:47:22.934320Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-22T19:47:30.339Z"}}], "cna": {"title": "Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function", "source": {"advisory": "GHSA-435c-mg9p-fv22", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "FlowiseAI", "product": "Flowise", "versions": [{"status": "affected", "version": "< cloud-hosted (as of Aug 2025)"}]}], "references": [{"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-435c-mg9p-fv22", "name": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-435c-mg9p-fv22", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive environment variables from other tenants via the Custom JavaScript Function node. This includes secrets such as OpenAI API keys, AWS credentials, Supabase tokens, and Google Cloud secrets \u2014 resulting in a full cross-tenant data exposure. This issue has been patched in the August 2025 Cloud-Hosted Flowise."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-22T19:39:03.774Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59434", "state": "PUBLISHED", "dateUpdated": "2025-09-22T19:47:56.540Z", "dateReserved": "2025-09-15T19:13:16.906Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-09-22T19:39:03.774Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive environment variables from other tenants via the Custom JavaScript Function node. This includes secrets such as OpenAI API keys, AWS credentials, Supabase tokens, and Google Cloud secrets \u2014 resulting in a full cross-tenant data exposure. This issue has been patched in the August 2025 Cloud-Hosted Flowise."}], "id": "CVE-2025-59434", "lastModified": "2025-09-22T21:22:16.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2025-09-22T20:15:39.017", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-435c-mg9p-fv22"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "Flowise: Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function", "id": "2397489", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397489"}, "csaw": false, "cwe": "(CWE-200|CWE-284)", "details": ["No description is available for this CVE."], "name": "CVE-2025-59434", "public_date": "2025-09-22T19:39:03Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-59434\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-59434\nhttps://github.com/FlowiseAI/Flowise/security/advisories/GHSA-435c-mg9p-fv22"], "threat_severity": "Critical"}