flowise-components vulnerabilities (npm)
32 vulnerabilities.
-
flowise-componentsnpm Flowise before 3.1.3 Prompt Injection RCE via CSV Agent 9.0 Critical -
flowise-componentsnpm Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore 9.0 Critical -
flowise-componentsnpm Flowise before 3.1.3 Sandbox Escape via Puppeteer 9.4 Critical -
flowise-componentsnpm Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability 9.5 Critical -
flowise-componentsnpm Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys 7.2 High -
flowise-componentsnpm Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE 9.5 Critical -
flowise-componentsnpm Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation 9.4 Critical -
flowise-componentsnpm Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) 8.7 High -
flowise-componentsnpm Flowise RCE via SQLite Record Manager Node 9.4 Critical -
flowise-componentsnpm Flowise: Remote Code Execution Vulnerability in CSVAgent 9.4 Critical -
flowise-componentsnpm Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified 9.2 Critical -
flowise-componentsnpm Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override 9.4 Critical -
flowise-componentsnpm Flowise Sandbox Escape to RCE 9.0 Critical -
flowise-componentsnpm Flowise RCE via TypeORM DataSource 9.0 Critical -
flowise-componentsnpm Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess 8.7 High -
flowise-componentsnpm Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability 9.2 Critical -
flowise-componentsnpm Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability 9.2 Critical -
flowise-componentsnpm Flowise: Cypher Injection in GraphCypherQAChain 9.3 Critical -
flowise-componentsnpm Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains 7.1 High -
flowise-componentsnpm Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) 7.1 High -
flowise-componentsnpm Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox 7.1 High -
flowise-componentsnpm Flowise: Flowise Parameter Override Bypass Remote Command Execution 7.7 High -
flowise-componentsnpm Flowise: Code Injection in CSVAgent leads to Authenticated RCE 9.4 Critical -
flowise-componentsnpm Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas. 8.3 High -
flowise-componentsnpm Flowise - Server-Side Request Forgery via Execute Flow Base URL 6.0 Medium -
flowise-componentsnpm Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) 5.3 Medium -
flowise-componentsnpm Flowise - Path Traversal in Vector Store basePath Parameter 4.9 Medium -
flowise-componentsnpm Flowise: Authenticated RCE Via MCP Adapters 10.0 Critical -
flowise-componentsnpm Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access 7.1 High -
flowise-componentsnpm Flowise is vulnerable to arbitrary file exposure through its ReadFileTool 7.7 High -
flowise-componentsnpm Flowise is vulnerable to arbitrary file read, arbitrary file write 10.0 Critical -
flowise-componentsnpm Flowise Vulnerable to SQL Injection via `tableName` Parameter 7.6 High