CVE-2024-36422: A reflected cross-site scripting (XSS) vulnerability affects Flowise version 1.4.3, a drag & drop interface for building large language model flows. The vulnerability resides in the api/v1/chatflows/id endpoint. Exploitation could allow an attacker to inject malicious Javascript into user sessions, stealing information or redirecting users. Although the CVSS score is 6.1, the SOCRadar Vulnerability Risk Score (SVRS) of 58 indicates a moderate risk. Successful exploitation can lead to sensitive data theft and potential server compromise. Given the presence of this vulnerability "In The Wild", immediate investigation and mitigation steps are advisable despite the lack of an official patch. Organizations using Flowise should closely monitor network traffic and user activity for suspicious behavior.