Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 14 total.
Code injection remote code execution in Flowise Airtable Agent node (CVE-2026-73485)
Flowise contains a code injection vulnerability in the run method of the Airtable_Agents class, where user-supplied prompts can cause the application to execute attacker-controlled Python code in an unsandboxed pyodid...
Fixed in 3.1.3
Code injection in Flowise CSV Agent customReadCSV parameter (CVE-2026-73486)
Flowise contains a code injection vulnerability in the CSV Agent node's `customReadCSV` parameter, where user-supplied input is substituted directly into a Python script prior to execution in an unsandboxed pyodide en...
Fixed in 3.1.3
Prompt injection to RCE and SSRF via Python validator bypass in Flowise (CVE-2026-73487)
Flowise CSV Agent and Airtable Agent nodes use a regex-based blocklist to validate LLM-generated Python code before execution in Pyodide. The blocklist has multiple structural bypasses - most critically, pandas URL-fe...
Fixed in 3.1.3
vm2 JavaScript sandbox escape to RCE in Flowise (CVE-2026-73602)
Flowise contains a sandbox escape vulnerability in its vm2-based JavaScript execution environment, affecting the Custom Function and Custom Tool nodes. An authenticated attacker can craft a fake String object whose `m...
Fixed in 3.1.3
Remote code execution in Flowise Custom MCP Config Node (CVE-2026-73601)
Flowise deployments with CUSTOM_MCP_PROTOCOL set to stdio (the default setting) are vulnerable to remote code execution through the Custom MCP node, which uses the StdioClientTransport MCP client. Authenticated users ...
Fixed in 3.1.3
Python validator Unicode homoglyph bypass in Flowise (CVE-2026-70470)
The `validatePythonCodeForDataFrame` function in Flowise's `pythonCodeValidator.ts` enforces a JavaScript regex blacklist against dangerous Python identifiers, but JavaScript word-boundary anchors (`\b`) are ASCII-onl...
Fixed in npm flowise 3.1.3; npm flowise-components 3.1.3
Remote code execution in Flowise CSVAgent via unsanitized csvFile interpolation (CVE-2026-69264)
Flowise's CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template executed by Pyodide without any content validation. Because Pyodide's default js bridg...
Fixed in 3.1.3
Remote code execution via pickle deserialization in Flowise CSVAgent (CVE-2026-69256)
The CSVAgent node in Flowise passes user-supplied input directly into a Python code template executed via pyodide, relying on a denylist to block dangerous constructs. An attacker can bypass this denylist by invoking ...
Fixed in npm flowise 3.1.3; npm flowise-components 3.1.3
JavaScript sandbox escape leading to RCE in Flowise (CVE-2026-69253)
An authenticated attacker can escape the vm2 JavaScript sandbox used by Flowise's AgentAsTool, ChatflowTool, and ExecuteFlow nodes by injecting arbitrary code through an unsanitized baseURL parameter, which is interpo...
Fixed in flowise 3.1.3; flowise-components 3.1.3
NodeVM sandbox escape leading to RCE in Flowise (CVE-2026-69254)
A sandbox escape vulnerability in Flowise's `executeJavaScriptCode()` function allows any authenticated user to execute arbitrary system commands as root on the Flowise server. The function merges caller-provided `nod...
Fixed in flowise 3.1.3; flowise-components 3.1.3
Prompt injection remote code execution in FlowiseAI Flowise CSV Agent (CVE-2026-41264)
A missing sandbox boundary in the `run` method of the `CSV_Agents` class allows the LLM-generated Python script to be evaluated without proper isolation. An unauthenticated remote attacker can use prompt injection to ...
Fixed in 3.1.0
Code injection in Flowise CSVAgent leads to remote code execution (CVE-2026-41137)
The CSVAgent component in Flowise accepts user-supplied custom Pandas CSV read code that is interpolated directly into an executable code string without sanitization and run via `pyodide.runPythonAsync`. An authentica...
Fixed in 3.1.0
Parameter override bypass remote command execution in Flowise (CVE-2026-41268)
Flowise contains a critical unauthenticated remote command execution vulnerability exploitable via a parameter override bypass using the FILE-STORAGE:: keyword combined with NODE_OPTIONS environment variable injection...
Fixed in 3.1.0
Remote code execution via prompt injection in Flowise Airtable Agent (CVE-2026-41265)
The `run` method of the `Airtable_Agents` class in Flowise evaluates an LLM-generated Python script without proper sandboxing. An unauthenticated remote attacker who can send prompts to a chatflow using the Airtable A...
Fixed in 3.1.0