Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-5xvg-pmgg-3mxr
  • npm/flowise
  • npm/flowise-components
 Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability 04 Aug
  • Fix available
  • Severity - 9.5 (Critical)
GHSA-4j8x-x6v7-w9rq
  • npm/flowise
  • npm/flowise-components
 Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation 04 Aug
  • Fix available
  • Severity - 9.4 (Critical)
GHSA-88pr-878c-24wf
  • npm/flowise
  • npm/flowise-components
 Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys 04 Aug
  • Fix available
  • Severity - 7.2 (High)
GHSA-52fh-8v99-63c2
  • npm/flowise
  • npm/flowise-components
 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE 04 Aug
  • Fix available
  • Severity - 9.5 (Critical)
GHSA-xc48-889x-5qmw
  • npm/flowise
  • npm/flowise-components
 Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) 04 Aug
  • Fix available
  • Severity - 8.7 (High)
GHSA-x3hf-7cj6-3r4m
  • npm/flowise
  • npm/flowise-components
 Flowise RCE via SQLite Record Manager Node 04 Aug
  • Fix available
  • Severity - 9.4 (Critical)
GHSA-x6vm-w76m-8j7g
  • npm/flowise
  • npm/flowise-components
 Flowise: Remote Code Execution Vulnerability in CSVAgent 04 Aug
  • Fix available
  • Severity - 9.4 (Critical)
GHSA-vmv7-4m6c-3cg5
  • npm/flowise
  • npm/flowise-components
 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified 04 Aug
  • Fix available
  • Severity - 9.2 (Critical)
GHSA-3769-jgqc-cxm7
  • npm/flowise
  • npm/flowise-components
 Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override 04 Aug
  • Fix available
  • Severity - 9.4 (Critical)
GHSA-wg86-r78f-74mp
  • npm/flowise
  • npm/flowise-components
 Flowise Sandbox Escape to RCE 04 Aug
  • Fix available
  • Severity - 9.0 (Critical)
GHSA-g32j-mmxr-gfq5
  • npm/flowise
  • npm/flowise-components
 Flowise RCE via TypeORM DataSource 04 Aug
  • Fix available
  • Severity - 9.0 (Critical)
GHSA-m99r-2hxc-cp3q
  • npm/flowise
  • npm/flowise-components
 Flowise has an MCP Security Bypass that Enables RCE 14 May
  • Fix available
  • Severity - 8.7 (High)
GHSA-3hjv-c53m-58jj
  • npm/flowise
  • npm/flowise-components
 Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability 21 Apr
  • Fix available
  • Severity - 9.2 (Critical)
GHSA-v38x-c887-992f
  • npm/flowise
  • npm/flowise-components
 Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability 18 Apr
  • Fix available
  • Severity - 9.2 (Critical)
GHSA-28g4-38q8-3cwc
  • npm/flowise
  • npm/flowise-components
 Flowise: Cypher Injection in GraphCypherQAChain 16 Apr
  • Fix available
  • Severity - 8.7 (High)
GHSA-6r77-hqx7-7vw8
  • npm/flowise
  • npm/flowise-components
 Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains 16 Apr
  • Fix available
  • Severity - 7.1 (High)
Load more...