FlowiseAI

4 results · Clear filters · Feed

• Critical 9.4
  CVE-2026-69254 Public exploit

  Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

  Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode() accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.…

  FlowiseAI Flowise flowise flowise-components npm
  Aug 4, 2026
• Critical 9.2
  CVE-2026-41264 Public exploit

  Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

  Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the run method of the CSV_Agents class. The issue results from the lack of proper sandboxing when evaluating an LLM genera…

  FlowiseAI Flowise flowise flowise-components npm
  Apr 23, 2026
• Critical 10.0
  CVE-2025-59528 Public exploit Scanner template EPSS 87%

  Flowise has Remote Code Execution vulnerability

  Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server…

  FlowiseAI Flowise flowise npm
  Sep 22, 2025
• Critical 9.8
  CVE-2025-58434 Public exploit Scanner template EPSS 83%

  Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

  Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication …

  FlowiseAI Flowise flowise npm
  Sep 12, 2025