Search for packages
| purl | pkg:npm/flowise-components@3.1.3 |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-4j8x-x6v7-w9rq
|
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation ### Summary Flowise's `CSVAgent` … |
CVE-2026-69264
|
|
GHSA-vmv7-4m6c-3cg5
|
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified ## UPDATE 2026-05-20: Full RCE as … |
CVE-2026-69255
|
|
GHSA-x6vm-w76m-8j7g
|
Flowise: Remote Code Execution Vulnerability in CSVAgent ### Summary The CSVAgent node was observed to allow users to write Python … |
CVE-2026-69256
|
|
GHSA-52fh-8v99-63c2
|
Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE ### Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with … |
CVE-2026-70470
|
|
GHSA-wg86-r78f-74mp
|
Flowise Sandbox Escape to RCE ============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: … |
CVE-2026-69253
|
|
GHSA-g32j-mmxr-gfq5
|
============================================================================= Security Advisory elttam Topic: Flowise RCE via TypeORM DataSource Module: FlowiseAI/Flowise Disclosed: 15-Apr-2026 Credits: Alex Brown Affects: `FlowiseAI/Flowise 3.1.2` … |
CVE-2026-69251
|
|
GHSA-x3hf-7cj6-3r4m
|
============================================================================= Security Advisory elttam Topic: Flowise RCE via SQLite Record Manager Node Module: FlowiseAI/Flowise Disclosed: 24-Apr-2026 Credits: Alex Brown Affects: … |
CVE-2026-69259
|
|
GHSA-xc48-889x-5qmw
|
Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) ## Summary The mitigation shipped for CVE-2025-8943 blocks … |
CVE-2026-69263
|
|
GHSA-5xvg-pmgg-3mxr
|
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability -- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a … |
CVE-2026-70477
|
|
GHSA-88pr-878c-24wf
|
Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys ## Summary Flowise on … | |
|
GHSA-3769-jgqc-cxm7
|
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override ### Summary A sandbox escape vulnerability in `executeJavaScriptCode()` allows any … |
CVE-2026-69254
|
|
GHSA-w7x8-q2gp-5cgg
|
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass ## Summary Flowise <= 3.1.2 CSV Agent … |
CVE-2026-73487
|
|
GHSA-9gvv-qjj3-2p6g
|
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium Flowise (packages flowise and … |
CVE-2026-73483
|
|
GHSA-6j9g-8fxc-25hq
|
Duplicate Advisory: Flowise contains an unauthenticated sandbox escape # Duplicate Advisory This advisory has been withdrawn because it is a … |