CVE-2026-69258 | FlowiseAI Flowise up to 3.1.2 Prediction Endpoint index.ts overrideConfig injection

A vulnerability was found in FlowiseAI Flowise up to 3.1.2. It has been declared as critical. This affects an unknown function of the file packages/server/src/utils/buildChatflow.ts/packages/server/src/utils/index.ts of the component Prediction Endpoint. Executing a manipulation of the argument overrideConfig can lead to injection.

This vulnerability appears as CVE-2026-69258. The attack may be performed from remote. There is no available exploit.

It is recommended to upgrade the affected component.