Which products and versions are affected by CVE-2025-55346?

Affected: flowise (npm). The full list is in the CVE brief.

Is CVE-2025-55346 being exploited in the wild?

It is exploited in the wild, listed in CIRCL KEV, Industry KEV feed since Nov 19, 2025.

Is CVE-2025-55346 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2025-55346?

A public exploit is reported by tracking sources, but no code link is listed yet.

Is there a fix for CVE-2025-55346?

No fixed version is listed yet; check the vendor advisory for mitigations.

How urgently should CVE-2025-55346 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

On CISA KEVCritical

CVE-2025-55346flowise Code Injection

Flowise vulnerable to RCE via Dynamic function constructor injection

Published Oct 6, 2025 · Updated Oct 6, 2025 · Also known as GHSA-hmgh-466j-fx4c

Key Facts

Patch immediately

CVE-2025-55346 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting flowise (npm).
It is exploited in the wild, listed in CIRCL KEV, Industry KEV feed since Nov 19, 2025. A public exploit is reported by tracking sources, but no code link is listed yet.
EPSS estimates a 22% probability of exploitation in the next 30 days.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Scores

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

22%

Higher than 97.6% of all scored CVEs

Exploit maturity

Exploited (KEV)

ATLAS score

49/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Nov 19, 2025

44 days after publication

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Exploited (KEV)

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Advisories And Exploit References

advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2025-55346
advisoryGHSA advisory

Description

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request.

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
CIRCL KEV	Nov 19, 2025	n/a	Not reported
Industry KEV feed	Nov 19, 2025	n/a	Not reported

Affected Products

2 affected entries in total

Product	Affected versions	Fixed in
flowisenpm	See advisory	n/a

Timeline

Publicly disclosed
Oct 6, 2025
Added to CIRCL KEV
Nov 19, 2025
Added to Industry KEV feed
Nov 19, 2025

Weakness Type

CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-627 Dynamic Variable Evaluation

References

11 more references in the full CVE brief

FAQ

Common Questions.

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request.
Affected: flowise (npm). The full list is in the CVE brief.
It is exploited in the wild, listed in CIRCL KEV, Industry KEV feed since Nov 19, 2025.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2025-55346 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.