Skip to content
OpenAdvisories

Product · FlowiseAI

flowise-components

7 known vulnerabilities.

flowise-components at a glance

Last 12 months
7
Critical · all time
4
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 6 vulnerabilities, 3 critical May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 1 vulnerability, 1 critical September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202611
Jul 202600
Jun 202600
May 202600
Apr 202663
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Critical 9.0
    CVE-2026-69251 Scanner template

    Flowise RCE via TypeORM DataSource

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in packages/com…

    FlowiseAI Flowise flowise-components flowise npm
  • Critical 9.3
    CVE-2026-41274

    Flowise: Cypher Injection in GraphCypherQAChain

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can in…

    FlowiseAI Flowise flowise-components flowise npm
  • High 7.1
    CVE-2026-41271

    Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) vulnerability exists in FlowiseAI's POST/GET API Chain components that allows unauthenticated attackers to force the …

    FlowiseAI Flowise flowise-components flowise npm
  • High 7.1
    CVE-2026-41272

    Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These…

    FlowiseAI Flowise flowise-components flowise npm
  • High 7.1
    CVE-2026-41270

    Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protecti…

    FlowiseAI Flowise flowise-components flowise npm
  • Critical 9.4
    CVE-2026-41137

    Flowise: Code Injection in CSVAgent leads to Authenticated RCE

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will ge…

    FlowiseAI Flowise flowise-components flowise npm
  • Critical 10.0
    CVE-2026-40933 EPSS 12%

    Flowise: Authenticated RCE Via MCP Adapters

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achievi…

    FlowiseAI Flowise flowise-components flowise npm