What is GHSA-pcg8-jx3g-5wm7?

GHSA-pcg8-jx3g-5wm7 is a security advisory published by GitHub Security Advisories with High severity. Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in...

Which CVE IDs does GHSA-pcg8-jx3g-5wm7 cover?

GHSA-pcg8-jx3g-5wm7 covers the following CVE IDs: CVE-2026-91937. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pcg8-jx3g-5wm7?

GHSA-pcg8-jx3g-5wm7 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-pcg8-jx3g-5wm7HighCVSS 7.5

Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in...

Vendor

GitHub Security Advisories

Published

September 15, 2026

Last Modified

September 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-91937 →

📋 Description

Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat history records belonging to other users from the shared collection.

🔗 References (4)

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wpvf-4vfx-rgxm
https://nvd.nist.gov/vuln/detail/CVE-2026-91937
https://www.vulncheck.com/advisories/flowise-before-3.1.4-nosql-injection-via-sessionid
https://github.com/advisories/GHSA-pcg8-jx3g-5wm7