GHSA-5cph-wvm9-45gj: 
JavaScript vulnerability analysis and mitigation

A high-severity security vulnerability was identified in Flowise npm package versions below 2.1.4, disclosed on November 21, 2024. The vulnerability relates to the overrideConfig option, which allows developers to inject configuration into the Chainflow during execution through both frontend web integration and backend Prediction API. This feature, while intentional, lacks proper security protections and poses significant security risks (GitHub Advisory).

The vulnerability has been assigned a CVSS v4 score of 8.6 (High severity). The technical assessment indicates network-based attack vector with low complexity, requiring high privileges but no user interaction. The vulnerability can lead to high impacts on confidentiality, integrity, and availability of the vulnerable system. The CVSS vector string is CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (GitHub Advisory).

The vulnerability presents multiple severe security implications including remote code execution capabilities with sandbox escape potential, Denial of Service (DoS) through server crashes, Server-Side Request Forgery (SSRF), prompt injection (both system and user levels), full control over LLM prompts, and server variable and data exfiltration. Additionally, it enables conversation flow alterations and prompt exfiltration via LLM proxying. While these issues are self-targeted and don't persist to other users, they expose both the server and business to significant risks (GitHub Advisory).

Several workarounds have been recommended: 1) overrideConfig should be disabled by default, 2) implementation of an explicit allow list for variables that can be modified, allowing opt-in control, 3) removal of vm2 and its forks due to impossible vulnerability fixing, with a recommendation to use isolated-vm (https://www.npmjs.com/package/isolated-vm) as a replacement. The vulnerability has been patched in version 2.1.4 and users should upgrade to this or later versions (GitHub Advisory).