Flowise through version 2.2.7 contains a SQL injection flaw in the importChatflows API. An authenticated user can supply a crafted JSON import file whose id field is concatenated unsanitized into a SQL IN clause, enabling execution of arbitrary SQL. This can lead to blind or error‑based extraction of sensitive data from the credential table, compromising confidentiality, integrity, and availability of the underlying database.

All Flowise releases up to and including version 2.2.7 are impacted, as the vulnerability exists in the core importChatflows code. No further version information was disclosed.

The CVSS score of 8.5 highlights a high severity with potential for data loss or corruption. Although the EPSS score is unavailable, the flaw is not currently listed in the CISA KEV catalog. Exploitation requires authenticated access to the API, so the likely attack vector involves a legitimate user role misusing the importChatflows endpoint to inject malicious SQL, resulting in database compromise and data exfiltration.