Security
فارسی
All products

flowise-components

npm · Package
31 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator BypassCVE-2026-73487 · GHSA-W7X8-Q2GP-5CGG flowise-componentsflowise npm Critical Fix reported
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via ChromiumCVE-2026-73483 · GHSA-9GVV-QJJ3-2P6G flowise-componentsflowise npm Critical Fix reported
Flowise Execute Flow function has an SSRF vulnerabilityCVE-2026-56275 · GHSA-9HRV-GVRV-6GF2 flowise-componentsflowise npm Medium Fix reported
Flowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityCVE-2026-70477 · GHSA-5XVG-PMGG-3MXR flowise-componentsflowise npm Critical Fix reported
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validationCVE-2026-69264 · GHSA-4J8X-X6V7-W9RQ flowise-componentsflowise npm Critical Fix reported
Flowise: Remote Code Execution Vulnerability in CSVAgentCVE-2026-69256 · GHSA-X6VM-W76M-8J7G flowise-componentsflowise npm Critical Fix reported
Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys GHSA-88PR-878C-24WF flowise-componentsflowise npm High Fix reported
Flowise: Pyodide validator Unicode homoglyph bypass leads to RCECVE-2026-70470 · GHSA-52FH-8V99-63C2 flowise-componentsflowise npm Critical Fix reported
Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)CVE-2026-69263 · GHSA-XC48-889X-5QMW flowise-componentsflowise npm High Fix reported
Flowise RCE via SQLite Record Manager NodeCVE-2026-69259 · GHSA-X3HF-7CJ6-3R4M flowise-componentsflowise npm Critical Fix reported
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell VerifiedCVE-2026-69255 · GHSA-VMV7-4M6C-3CG5 flowise-componentsflowise npm Critical Fix reported
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions OverrideCVE-2026-69254 · GHSA-3769-JGQC-CXM7 flowise-componentsflowise npm Critical Fix reported
Flowise Sandbox Escape to RCECVE-2026-69253 · GHSA-WG86-R78F-74MP flowise-componentsflowise npm Critical Fix reported
Flowise RCE via TypeORM DataSourceCVE-2026-69251 · GHSA-G32J-MMXR-GFQ5 flowise-componentsflowise npm Critical Fix reported
Flowise: Path Traversal in Vector Store basePathCVE-2026-56273 · GHSA-W6V6-49GH-MC9W flowise-componentsflowise npm Medium Fix reported
Flowise has an MCP Security Bypass that Enables RCECVE-2026-56274 · GHSA-M99R-2HXC-CP3Q flowise-componentsflowise npm High Fix reported
Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)CVE-2026-43995 · GHSA-QQVM-66Q4-VF5C flowise-componentsflowise npm Medium Fix reported
Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function SandboxCVE-2026-41270 · GHSA-XHMJ-RG95-44HV flowise-componentsflowise npm High Fix reported
Flowise: Airtable_Agent Code Injection Remote Code Execution VulnerabilityCVE-2026-41265 · GHSA-V38X-C887-992F flowise-componentsflowise npm Critical Fix reported
Flowise: Cypher Injection in GraphCypherQAChainCVE-2026-41274 · GHSA-28G4-38Q8-3CWC flowise-componentsflowise npm High Fix reported