CVE-2024-36423 is a reflected Cross-Site Scripting (XSS) vulnerability found in Flowise version 1.4.3. This flaw in the /api/v1/public-chatflows/id endpoint allows attackers to inject malicious JavaScript into user sessions via a specially crafted URL, particularly when the default unauthenticated configuration is active. The vulnerability arises because the chatflow ID is reflected in the 404 error page without proper sanitization, enabling the injection of arbitrary scripts.

Although the CVSS score is 6.1, the SOCRadar Vulnerability Risk Score (SVRS) is 30, suggesting a lower immediate threat level compared to critical vulnerabilities with SVRS scores above 80. Successful exploitation could lead to information theft, deceptive pop-ups, or redirection to malicious websites. Moreover, this XSS can be combined with path injection techniques to enable unauthorized file access on the Flowise server. The absence of available patches at the time of disclosure highlights the importance of implementing mitigating security measures.