Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · <= 3.1.2 · CVE-2026-69254 · GHSA-3769-jgqc-cxm7 · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
51–57 of 57 matching · newest first
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · <= 3.1.2 · CVE-2026-69254 · GHSA-3769-jgqc-cxm7 · amended
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · <= 3.1.2 · CVE-2026-69253 · GHSA-wg86-r78f-74mp · amended
/api/v1/files allows low-privileged API keys to list and delete files across workspaces within the same organizationnpm flowise · Upgrade to 3.1.3 or later · <= 3.1.2 · CVE-2026-69252 · GHSA-wp74-f5hh-5f3r
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · <= 3.1.2 · CVE-2026-69251 · GHSA-g32j-mmxr-gfq5 · amended
npm flowise · Upgrade to 3.1.3 or later · <= 3.1.2 · CVE-2026-69250 · GHSA-r745-8hwv-h473
npm flowise · Upgrade to 3.1.3 or later · <= 3.1.2 · CVE-2026-73488 · GHSA-2364-jh4q-m9vm · amended
ReadChunk::commit when an element's Drop panicscrates.io rtrb · Upgrade to 0.4.0 or 0.3.5 by release line · >= 0.0.0-0, < 0.3.5; >= 0.4.0-0, < 0.4.0
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.