Skip to content
OpenAdvisories

Product · FlowiseAI

flowise-components

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-69251 Scanner template

    Flowise RCE via TypeORM DataSource

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in packages/com…

    FlowiseAI Flowise flowise-components flowise npm
  • Critical 9.3
    CVE-2026-41274

    Flowise: Cypher Injection in GraphCypherQAChain

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can in…

    FlowiseAI Flowise flowise-components flowise npm
  • Critical 9.4
    CVE-2026-41137

    Flowise: Code Injection in CSVAgent leads to Authenticated RCE

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will ge…

    FlowiseAI Flowise flowise-components flowise npm
  • Critical 10.0
    CVE-2026-40933 EPSS 12%

    Flowise: Authenticated RCE Via MCP Adapters

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achievi…

    FlowiseAI Flowise flowise-components flowise npm