What is GHSA-j6jh-78h2-2667?

GHSA-j6jh-78h2-2667 is a security advisory published by GitHub Security Advisories with High severity. Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio,...

Which CVE IDs does GHSA-j6jh-78h2-2667 cover?

GHSA-j6jh-78h2-2667 covers the following CVE IDs: CVE-2026-91938. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j6jh-78h2-2667?

GHSA-j6jh-78h2-2667 has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

GHSA-j6jh-78h2-2667HighCVSS 7.1

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio,...

Vendor

GitHub Security Advisories

Published

September 15, 2026

Last Modified

September 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-91938 →

📋 Description

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response content returned as document text.

🔗 References (4)

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9cvr-5wv9-2gxr
https://nvd.nist.gov/vuln/detail/CVE-2026-91938
https://www.vulncheck.com/advisories/flowise-before-3.1.4-server-side-request-forgery-via-document-loaders
https://github.com/advisories/GHSA-j6jh-78h2-2667