Skip to content
OpenAdvisories
High WID-SEC-2026-2589 29 CVEs

Flowise: Mehrere Schwachstellen

Published Jul 29, 2026 · Updated Sep 9, 2026 · Revision 4 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Code auszuführen – sogar mit Root-Rechten –, erweiterte Privilegien zu erlangen, Sicherheitsmaßnahmen zu umgehen, Sitzungen zu kapern sowie Daten offenzulegen oder zu manipulieren.

Product

Flowise ist eine Benutzeroberfläche zur Erstellung von LLMs (Large Language Model).

Vulnerabilities 29

  • Critical 9.5
    CVE-2026-70470

    Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbi…

    FlowiseAI Flowise flowise flowise-components npm
  • Critical 9.5
    CVE-2026-70477

    Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist valid…

    FlowiseAI Flowise flowise flowise-components npm
  • Critical 9.4
    CVE-2026-69254 Public exploit

    Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode() accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.…

    FlowiseAI Flowise flowise flowise-components npm
  • Critical 9.4
    CVE-2026-69256

    Flowise: Remote Code Execution Vulnerability in CSVAgent

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.r…

    FlowiseAI Flowise flowise flowise-components npm
  • Critical 9.4
    CVE-2026-69259

    Flowise RCE via SQLite Record Manager Node

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalCo…

    FlowiseAI Flowise flowise flowise-components npm
  • Critical 9.4
    CVE-2026-69264

    Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

    Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Nod…

    FlowiseAI Flowise flowise flowise-components npm
  • Critical 9.4
    CVE-2026-73483

    Flowise before 3.1.3 Sandbox Escape via Puppeteer

    Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying…

    FlowiseAI Flowise
  • Critical 9.2
    CVE-2026-69255

    Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split(',').pop() and interpolated i…

    FlowiseAI Flowise flowise flowise-components npm
  • Critical 9.2
    CVE-2026-70478

    Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST_URLS and requires no authentication. The endpoint decrypts the …

    FlowiseAI Flowise flowise npm
  • Critical 9.0
    CVE-2026-69251 Scanner template

    Flowise RCE via TypeORM DataSource

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in packages/com…

    FlowiseAI Flowise flowise-components flowise npm
  • Critical 9.0
    CVE-2026-69253

    Flowise Sandbox Escape to RCE

    Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process  vm2  sandbox. To build that c…

    FlowiseAI Flowise flowise flowise-components npm
  • Critical 9.0
    CVE-2026-73485

    Flowise before 3.1.3 Remote Code Execution via Airtable Agent

    Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send cr…

    FlowiseAI Flowise
  • Critical 9.0
    CVE-2026-73486

    Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV

    Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfusca…

    FlowiseAI Flowise
  • Critical 9.0
    CVE-2026-73487

    Flowise before 3.1.3 Prompt Injection RCE via CSV Agent

    Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.read_json() …

    FlowiseAI Flowise flowise flowise-components npm
  • Critical 9.0
    CVE-2026-73601

    Flowise before 3.1.3 Remote Code Execution via Custom MCP

    Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments…

    FlowiseAI Flowise
  • Critical 9.0
    CVE-2026-73602

    Flowise before 3.1.3 Sandbox Escape to RCE

    Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function …

    FlowiseAI Flowise
  • High 8.8
    CVE-2026-69258

    Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flow…

    FlowiseAI Flowise flowise npm
  • High 8.7
    CVE-2026-69263 Public exploit

    Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYL…

    FlowiseAI Flowise flowise flowise-components npm
  • High 8.6
    CVE-2026-73484

    Flowise before 3.1.3 Sandbox Escape via Pandas Methods

    Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write…

    FlowiseAI Flowise
  • High 8.5
    CVE-2026-69250

    Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP reques…

    FlowiseAI Flowise flowise npm
  • High 8.3
    CVE-2026-70473

    Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

    Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or wor…

    FlowiseAI Flowise flowise npm
  • High 8.3
    CVE-2026-70476

    Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organ…

    FlowiseAI Flowise flowise npm
  • High 7.6
    CVE-2026-69257

    Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise's HTTP security module httpSecurity.ts did not normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254 before che…

    FlowiseAI Flowise flowise npm
  • High 7.6
    CVE-2026-70474

    Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

    Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and ref…

    FlowiseAI Flowise flowise npm
  • High 7.2
    CVE-2026-69252

    Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authentic…

    FlowiseAI Flowise flowise npm
  • High 7.1
    CVE-2026-69262

    Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, `DELETE /api/v1/chatflows/:id` authorized requests with checkAnyPermission('chatflows:delete,agentflows:delete'), so possession of either permission was s…

    FlowiseAI Flowise flowise npm
  • High 7.1
    CVE-2026-70471

    Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

    Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Varia…

    FlowiseAI Flowise flowise npm
  • High 7.1
    CVE-2026-70472

    Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise openai-assistants-vector-store endpoints accept a client-controlled credential parameter and load credentials by id without checking whether that …

    FlowiseAI Flowise flowise npm
  • High 7.1
    CVE-2026-70475

    Flowise: Missing Authorization on Execution Update Endpoint

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other ex…

    FlowiseAI Flowise flowise npm

Revision history

  1. #4

    Referenz(en) aufgenommen: ZDI-26-634, ZDI-CAN-30459

  2. #3

    Referenz(en) aufgenommen: CVE-2026-73601, EUVD-2026-57805, CVE-2026-73602, EUVD-2026-57806, CVE-2026-73486, EUVD-2026-57802, CVE-2026-73484, EUVD-2026-57800, CVE-2026-73487, EUVD-2026-57803, CVE-2026-73485, EUVD-2026-57801, CVE-2026-73483, EUVD-2026-57799

  3. #2

    CVE's ergänzt

  4. #1

    Initiale Fassung

References