CVE-2025-57164
📋 TL;DR
CVE-2025-57164 allows remote code execution in Flowise AI platforms through unsanitized user input in the Supabase RPC Filter field. Attackers can execute arbitrary code on vulnerable Flowise instances. All Flowise deployments up to version 3.0.4 are affected.
💻 Affected Systems
- Flowise AI
📦 What is this software?
Flowise by Flowiseai
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, steal data, install malware, or pivot to other systems.
Likely Case
Unauthorized code execution leading to data exfiltration, credential theft, or deployment of backdoors.
If Mitigated
Limited impact if proper input validation and sandboxing are implemented, potentially preventing code execution.
🎯 Exploit Status
Exploitation requires access to Flowise interface and knowledge of the vulnerable field.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.0.5 or later
Vendor Advisory: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-7944-7c6r-55vv
Restart Required: No
Instructions:
1. Update Flowise to version 3.0.5 or later. 2. Run 'npm update' in Flowise directory. 3. Restart Flowise service.
🔧 Temporary Workarounds
Disable Supabase RPC Filter
allTemporarily disable or restrict access to the vulnerable Supabase RPC Filter functionality.
Input Validation Rules
allImplement strict input validation for all user-supplied data in Flowise configuration.
🧯 If You Can't Patch
- Network segmentation to isolate Flowise instances from critical systems
- Implement strict access controls and authentication for Flowise interface
🔍 How to Verify
Check if Vulnerable:
Check Flowise version - if version is 3.0.4 or earlier, system is vulnerable.Check Version:
Check package.json or run 'npm list flowise' in Flowise directoryVerify Fix Applied:
Verify Flowise version is 3.0.5 or later and test Supabase RPC Filter functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns
- Suspicious input in Supabase-related logs
- Error messages related to code evaluation
Network Indicators:
- Unexpected outbound connections from Flowise server
- Unusual data exfiltration patterns
SIEM Query:
source="flowise" AND ("Supabase" OR "RPC" OR "eval") AND (error OR suspicious)