Flowiseai Flowise-Components vulnerabilities

CVE-2026-69251 [CRITICAL] CWE-94 CVE-2026-69251: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts, packages/components/n

CVE-2026-40933 [CRITICAL] CWE-78 CVE-2026-40933: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution. The vulnerability lies in a bug in the input sanitization from the “C

CVE-2026-69264 [CRITICAL] CWE-94 Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation ### Summary Flowise's `CSVAgent` interpolates an attacker-controlled segment of the `csvFile` data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default `js` bridge to `gl

CVE-2026-41274 [CRITICAL] CWE-943 CVE-2026-41274: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are executed on the underlying Neo4j database, enablin

CVE-2026-41137 [HIGH] CWE-94 CVE-2026-41137: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and executed by the server. This vulnerability is fixed in 3.1.0.

CVE-2026-70470 [CRITICAL] CWE-184 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE ### Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This reopens the RCE paths patched as GHSA

CVE-2026-69254 [CRITICAL] CWE-94 Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override ### Summary A sandbox escape vulnerability in `executeJavaScriptCode()` allows any authenticated user to execute arbitrary system commands as root on the Flowise server. The function accepts caller-provided `nodeVMOptions` that override the default sandbox security settings via JavaScrip

CVE-2026-70477 [CRITICAL] CWE-94 Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability -- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: Flowise - Flowise -- VULNERABILITY DETAILS ------------------------ * Version tested: 3.1.1 * Installer file: https://github.com/FlowiseAI/Flowise (npm install [email protected]

CVE-2026-69255 [CRITICAL] CWE-94 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified ## UPDATE 2026-05-20: Full RCE as root VERIFIED **This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2.** ### Verified Exploit Chain 1. Python code injection via `base64_string = "${base64String}"` (CSVAgent.ts line 161) 2. Pyod

CVE-2026-69256 [CRITICAL] CWE-94 Flowise: Remote Code Execution Vulnerability in CSVAgent Flowise: Remote Code Execution Vulnerability in CSVAgent ### Summary The CSVAgent node was observed to allow users to write Python code which gets executed via `pyodide`. The original intent was to allow users to utilise the `pandas` library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, `pandas` has a `read_pickle()` [function](https://p

CVE-2026-69259 [CRITICAL] CWE-94 Flowise RCE via SQLite Record Manager Node Flowise RCE via SQLite Record Manager Node Security Advisory elttam Topic: Flowise RCE via SQLite Record Manager Node Module: FlowiseAI/Flowise Disclosed: 24-Apr-2026 Credits: Alex Brown Affects: `FlowiseAI/Flowise 3.1.2` # I. Background Flowise AI is an open-source, low-code platform for building AI applications—such as chatbots, workflows, and autonomous agents—through an intuitive drag-and-drop interface, minimis

CVE-2026-41271 [HIGH] CWE-918 CVE-2026-41271: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) vulnerability exists in FlowiseAI's POST/GET API Chain components that allows unauthenticated attackers to force the server to make arbitrary HTTP requests to internal and external systems. By injecting maliciou

CVE-2026-41270 [HIGH] CWE-284 CVE-2026-41270: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTP_DENY_LIST for axios and node-fetch libraries, the built-in Node.js http, https, an

CVE-2026-69263 [CRITICAL] CWE-184 Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) ## Summary The mitigation shipped for CVE-2025-8943 blocks the `-y` and `--yes` flags on `npx` to stop auto-installation of arbitrary packages. That flag filter works. The environment-variable check in the same patch denies only

CVE-2026-69253 [CRITICAL] CWE-95 Flowise Sandbox Escape to RCE Flowise Sandbox Escape to RCE Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: Luke Jahnke and Alex Brown Affects: `FlowiseAI/Flowise 3.1.1`, `FlowiseAI/nodevm 3.9.25` # I. Background Flowise AI is an open-source, low-code platform for building AI applications—such as chatbots, workflows, and autonomous agents—through an intuitive drag-a

CVE-2026-41272 [HIGH] CWE-918 CVE-2026-41272: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of