CVE-2026-91938 — Flowise before 3.1.4 Server-Side Request Forgery via document loaders
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attack…
Published: 2026-09-15 · CVSS: 7.6 · CVSS 4.0
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response content returned as document text.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7