Flowise versions earlier than 3.0.8 contain a cross‑site scripting vulnerability caused by inadequate input filtering in chat messages and custom agent functions. An attacker can insert a malicious iframe payload or have a custom agent return disallowed JavaScript from an external source. When the victim views the chat content, the injected script runs in their browser, allowing the attacker to steal cookies, session identifiers, and other sensitive information stored in the browser. This flaw is a classic example of client‑side script injection (CWE‑80).

All deployments of Flowise running a version prior to 3.0.8 are affected; versions 3.0.8 and later do not include the flaw. No other vendors or products are listed as impacted.

The CVSS score of 5.1 indicates moderate risk; exploitation requires the attacker to send a crafted message or agent response that the victim subsequently views. The vulnerability is exploitable over the network through the chat interface and does not provide direct server‑side code execution. EPSS is not available, and the vulnerability is currently not listed in the CISA KEV catalog. Attackers would exploit this by targeting users who view chat or agent responses to obtain session credentials.