Search for packages
| purl | pkg:npm/flowise@3.1.3 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-8gj2-2cvc-6xx7
|
Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials ## Summary The `/api/v1/text-to-speech/generate` endpoint … |
Not vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-4j8x-x6v7-w9rq
|
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation ### Summary Flowise's `CSVAgent` … |
CVE-2026-69264
|
|
GHSA-p5w8-m249-4r4v
|
Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type # summary: … |
CVE-2026-69262
|
|
GHSA-6vh2-wg4h-4vwj
|
Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API #### Summary The `POST /api/v1/prediction/:id` … |
CVE-2026-69258
|
|
GHSA-c6xh-wv4j-ppv5
|
Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses ## Summary Flowise's HTTP security module (`httpSecurity.ts`) fails to normalize IPv4-mapped IPv6 … |
CVE-2026-69257
|
|
GHSA-vmv7-4m6c-3cg5
|
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified ## UPDATE 2026-05-20: Full RCE as … |
CVE-2026-69255
|
|
GHSA-x6vm-w76m-8j7g
|
Flowise: Remote Code Execution Vulnerability in CSVAgent ### Summary The CSVAgent node was observed to allow users to write Python … |
CVE-2026-69256
|
|
GHSA-52fh-8v99-63c2
|
Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE ### Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with … |
CVE-2026-70470
|
|
GHSA-fr6g-7cq8-fg82
|
Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history ### Summary The **GET `/api/v1/upsert-history`** endpoint returns the … |
CVE-2026-70473
|
|
GHSA-wg86-r78f-74mp
|
Flowise Sandbox Escape to RCE ============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: … |
CVE-2026-69253
|
|
GHSA-qgvm-j2hm-6m38
|
Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service ### Summary The … |
CVE-2026-70478
|
|
GHSA-chm3-vqcf-52rx
|
Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store # Summary These endpoints accept a client-controlled `credential` parameter. The server loads credentials by … |
CVE-2026-70472
|
|
GHSA-wp74-f5hh-5f3r
|
Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization … |
CVE-2026-69252
|
|
GHSA-g32j-mmxr-gfq5
|
============================================================================= Security Advisory elttam Topic: Flowise RCE via TypeORM DataSource Module: FlowiseAI/Flowise Disclosed: 15-Apr-2026 Credits: Alex Brown Affects: `FlowiseAI/Flowise 3.1.2` … |
CVE-2026-69251
|
|
GHSA-x3hf-7cj6-3r4m
|
============================================================================= Security Advisory elttam Topic: Flowise RCE via SQLite Record Manager Node Module: FlowiseAI/Flowise Disclosed: 24-Apr-2026 Credits: Alex Brown Affects: … |
CVE-2026-69259
|
|
GHSA-rwrp-9823-p2xq
|
Flowise: Incomplete Credential Redaction Exposes Secrets via API ## Summary The `GET /api/v1/credentials/:id` endpoint decrypts stored credential data and returns … | |
|
GHSA-fm2f-4339-4p2f
|
Flowise: Missing Authorization on Execution Update Endpoint # Flowise Security Audit Report **Date**: 2026-03-17 **Researcher**: Dimpal Jadhav (jadhavdimpy@gmail.com) **GitHub**: https://github.com/Dimpyj1604 … |
CVE-2026-70475
|
|
GHSA-xc48-889x-5qmw
|
Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) ## Summary The mitigation shipped for CVE-2025-8943 blocks … |
CVE-2026-69263
|
|
GHSA-gmmw-qg98-6j6p
|
Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation ### Summary Several organization billing endpoints accept attacker-controlled … |
CVE-2026-70476
|
|
GHSA-wch5-xp77-fxg4
|
Flowise: Cross-Workspace OAuth2 Credential Metadata Leak ## Summary Three OAuth2 credential endpoints look up credentials by `id` alone with no … |
CVE-2026-70474
|
|
GHSA-5xvg-pmgg-3mxr
|
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability -- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a … |
CVE-2026-70477
|
|
GHSA-8r8h-6vcc-xhrv
|
Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure ## Finding — Unauthorized Workspace Variables disclosure via $vars injection (bypasses … |
CVE-2026-70471
|
|
GHSA-88pr-878c-24wf
|
Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys ## Summary Flowise on … | |
|
GHSA-2364-jh4q-m9vm
|
Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint ### Summary An Insecure Direct Object Reference (IDOR) vulnerability exists at … | |
|
GHSA-r745-8hwv-h473
|
Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration ### Summary The OAuth2 token refresh endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) is … |
CVE-2026-69250
|
|
GHSA-3769-jgqc-cxm7
|
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override ### Summary A sandbox escape vulnerability in `executeJavaScriptCode()` allows any … |
CVE-2026-69254
|
|
GHSA-w7x8-q2gp-5cgg
|
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass ## Summary Flowise <= 3.1.2 CSV Agent … |
CVE-2026-73487
|
|
GHSA-9gvv-qjj3-2p6g
|
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium Flowise (packages flowise and … |
CVE-2026-73483
|
|
GHSA-6j9g-8fxc-25hq
|
Duplicate Advisory: Flowise contains an unauthenticated sandbox escape # Duplicate Advisory This advisory has been withdrawn because it is a … |