Flowiseai

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-70470	Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDataFrame) can be defeated with Unicode homoglyph identifiers, letting an attacker run arbitrary Python that escapes the Pyodide sandbox and executes OS commands on the Flowise host with the process's privileges. The affected CSV Agent and Airtable Agent nodes gate LLM-generated (and config-supplied) Python through an ASCII word-boundary regex blacklist, which Python's NFKC identifier normalization silently rewrites back into the forbidden dunders. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the GitHub advisory documents a complete, reproducible bypass technique, so weaponization is straightforward; the vendor rates it 9.5 (CVSS 4.0).	CRITICAL	9.5	0.5%	68	PoC
CVE-2026-69264	Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise process by abusing the CSVAgent node, which interpolates an attacker-controlled base64 segment of the csvFile data URI directly into a Python template run by Pyodide. Because Pyodide's default js bridge exposes globalThis (including eval and dynamic import on Node.js), the injected code can break out of the Python string, call js.eval, import fs and child_process, and run host commands; the surrounding validators are never applied to this bootstrap template. A low-privileged workspace user plants the malicious node, after which any unauthenticated request to the public POST /api/v1/prediction/:id endpoint triggers the RCE. No public exploit is identified at time of analysis (no KEV, no POC signal in the provided data), but the fix is confirmed in version 3.1.3.	CRITICAL	9.4	0.6%	68	PoC
CVE-2026-73483	Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScript sandbox by abusing the /api/v1/node-custom-function endpoint. By passing attacker-controlled executablePath and args into puppeteer.launch(), the code reaches child_process.spawn() outside the sandbox, yielding arbitrary OS command execution as the Flowise process user (root in the official Docker image) and host file disclosure via Chromium's file:// handling. No public exploit is identified at time of analysis, but a vendor security advisory (GHSA-9gvv-qjj3-2p6g) and VulnCheck confirm the flaw; the CVSS 4.0 base score is 9.4.	CRITICAL	9.4	0.4%	67	PoC
CVE-2026-46442	Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key to submit arbitrary JavaScript via POST /api/v1/node-custom-function, which executes inside a NodeVM sandbox that can be escaped to reach the host process and spawn child processes. CVSS 4.0 scores this 9.4 Critical, and publicly available exploit details exist via the GHSA advisory, though no public exploit identified at time of analysis in CISA KEV. The flaw stems from missing route-level authorization combined with a sandbox that Flowise itself documents as a security boundary but which fails to contain malicious payloads.	CRITICAL	9.4	0.3%	67	PoC
CVE-2026-73601	Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTOCOL is set to stdio - to run arbitrary OS commands on the host. By manipulating environment variables (PYTHONWARNINGS, BROWSER) passed to python3 or leveraging node with the root working directory, an attacker bypasses input validation and achieves command execution as the Flowise service account. Reported by VulnCheck with a CVSS 4.0 score of 9.0; no public exploit is identified at time of analysis, though the technique is documented in detail in the vendor advisory.	CRITICAL	9.0	0.6%	66	PoC
CVE-2026-73602	Remote code execution in Flowise before 3.1.3 lets authenticated users escape the vm2 JavaScript sandbox and run arbitrary code on the host. By abusing a moment.js locale-validation weakness, an attacker supplies a forged String object whose match function defeats the path-traversal check, causing Flowise to load and execute an attacker-planted JavaScript file from the document store outside the sandbox. Reported by VulnCheck and fixed by the vendor; no public exploit or CISA KEV listing was identified at time of analysis, though the CVSS 4.0 base score of 9.0 reflects full compromise of confidentiality, integrity, and availability.	CRITICAL	9.0	0.4%	65	PoC
CVE-2026-73487	Remote code execution and SSRF in FlowiseAI Flowise before 3.1.3 stems from a bypassable regex-based Python code validator in the CSV and Airtable Agent nodes, letting attackers smuggle malicious pandas calls through the unauthenticated prediction API via prompt injection. Because the validator blocklists rather than sandboxes, unblocked functions such as pd.read_json() can be abused to exfiltrate local datasets, reach internal services (SSRF), or execute arbitrary code. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the reporting vendor VulnCheck and a GitHub Security Advisory (GHSA-w7x8-q2gp-5cgg) document the issue.	CRITICAL	9.0	0.4%	65	PoC
CVE-2026-73486	Authenticated arbitrary Python code execution in FlowiseAI Flowise before 3.1.3 arises from the CSV Agent node's customReadCSV parameter, whose regex-based validator can be defeated with obfuscation to run attacker-supplied code inside an unsandboxed pyodide runtime with full host access. Any user able to build or edit a chatflow can escalate from application-level access to code execution on the server. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch exists in version 3.1.3.	CRITICAL	9.0	0.3%	65	PoC
CVE-2026-73485	Remote code execution in Flowise before 3.1.3 lets attackers run arbitrary Python on the host by abusing the Airtable Agent node. Crafted chatflow prompts carry obfuscated Python that slips past the pythonCodeValidator blocklist and executes inside an unsandboxed pyodide runtime with full access to the underlying OS. Reported by VulnCheck with a published GHSA advisory; no public exploit code is identified at time of analysis, and it is not listed in CISA KEV.	CRITICAL	9.0	0.3%	65	PoC
CVE-2026-71962	Unauthenticated file exfiltration in Flowise 2.2.4-3.1.4 is possible because the POST /api/v1/openai-assistants-file/download endpoint was incorrectly added to the application's global authentication whitelist, causing all session and API key verification to be skipped unconditionally. Any remote, unauthenticated attacker who can supply valid chatflowId, chatId, and fileName identifiers can retrieve private files from any chatflow on the instance, including those belonging to other workspaces or organizations in a multi-tenant deployment. A public proof-of-concept exploit is available via GitHub, and no KEV listing has been confirmed at time of analysis.	HIGH	8.7	0.4%	64	PoC No patch
CVE-2026-69263	Flowise's patch for CVE-2025-8943 is fully bypassed in versions up to and including 3.1.2, allowing unauthenticated remote code execution on default deployments via the npm_config_yes environment variable. The prior mitigation blocked the -y and --yes flags on npx and denied four specific environment variable names by exact string match, but npm natively reads its configuration from any npm_config_* prefixed variable, making npm_config_yes=true semantically equivalent to --yes. Any attacker who can submit a Custom MCP stdio server configuration - which requires no authentication on default Flowise deployments - can force npx to auto-install and execute an arbitrary package as the Flowise server process. No public exploit code has been identified at time of analysis, though the bypass technique is fully documented in the public GHSA advisory GHSA-xc48-889x-5qmw, making independent weaponization trivial.	HIGH	8.7	0.3%	64	PoC
CVE-2026-73484	Sandbox escape in Flowise's Python code execution layer (pythonCodeValidator.ts) allows authenticated low-privilege users to invoke native Pandas DataFrame methods - to_csv, to_json, pipe, and query - that the validator's denylist fails to restrict. All Flowise deployments prior to version 3.1.3 are vulnerable, with a CVSS 4.0 score of 8.6 reflecting high confidentiality and high integrity impact. A successful attacker can exfiltrate uploaded CSV data or write arbitrary files to the server filesystem; no public exploit has been identified at time of analysis, but the attack primitives are fully documented in the advisory.	HIGH	8.6	0.3%	63	PoC
CVE-2026-67622	Cross-workspace credential theft in Flowise through 3.1.4 exploits a missing workspace-scoped authorization check in the OpenAI Assistants integration, enabling authenticated users to access credentials owned by unrelated workspaces by supplying arbitrary credential UUIDs. The flaw exposes multi-tenant deployments: an attacker with any valid account can enumerate assistant metadata, retrieve file and vector store listings, and write files into victim workspaces without owning or having delegated access to the target workspace. No KEV listing at time of analysis, but a public advisory exists; the product appears to have entered sunset, potentially leaving the vulnerability unpatched.	HIGH	8.5	0.2%	63	PoC No patch
CVE-2026-70476	Cross-tenant billing manipulation in Flowise's enterprise API allows any authenticated user to perform unauthorized Stripe subscription operations against other organizations by supplying an arbitrary victim subscriptionId to the /update-subscription-plan and /update-additional-seats endpoints. All Flowise enterprise deployments running versions prior to 3.1.3 are affected, with impact including unauthorized plan downgrades, seat-count inflation (inflating victim billing), and service disruption across tenants. No public exploit code or CISA KEV listing exists at time of analysis, but the vulnerability is mechanically straightforward given knowledge of a target organization's Stripe subscription identifier.	HIGH	8.3	0.3%	62	PoC
CVE-2026-70474	Cross-workspace OAuth2 credential isolation failure in Flowise prior to version 3.1.3 enables two distinct attack classes: authenticated users can initiate OAuth2 flows against credentials owned by other workspaces, and - more critically - unauthenticated attackers can forge OAuth2 callbacks to overwrite tokens or trigger token refreshes for any credential system-wide by exploiting a whitelist that bypasses all authentication on the /callback and /refresh endpoints. The root cause is that all three OAuth2 handlers query the Credential table by credential ID alone, omitting the workspaceId isolation enforced elsewhere in the codebase. No public exploit has been identified at time of analysis, and the issue is fixed in Flowise 3.1.3.	HIGH	7.6	0.3%	58	PoC

CVE-2026-70470

Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDataFrame) can be defeated with Unicode homoglyph identifiers, letting an attacker run arbitrary Python that escapes the Pyodide sandbox and executes OS commands on the Flowise host with the process's privileges. The affected CSV Agent and Airtable Agent nodes gate LLM-generated (and config-supplied) Python through an ASCII word-boundary regex blacklist, which Python's NFKC identifier normalization silently rewrites back into the forbidden dunders. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the GitHub advisory documents a complete, reproducible bypass technique, so weaponization is straightforward; the vendor rates it 9.5 (CVSS 4.0).

CRITICAL

9.5

0.5%

68

PoC

CVE-2026-69264

Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise process by abusing the CSVAgent node, which interpolates an attacker-controlled base64 segment of the csvFile data URI directly into a Python template run by Pyodide. Because Pyodide's default js bridge exposes globalThis (including eval and dynamic import on Node.js), the injected code can break out of the Python string, call js.eval, import fs and child_process, and run host commands; the surrounding validators are never applied to this bootstrap template. A low-privileged workspace user plants the malicious node, after which any unauthenticated request to the public POST /api/v1/prediction/:id endpoint triggers the RCE. No public exploit is identified at time of analysis (no KEV, no POC signal in the provided data), but the fix is confirmed in version 3.1.3.

CRITICAL

9.4

0.6%

68

PoC

CVE-2026-73483

Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScript sandbox by abusing the /api/v1/node-custom-function endpoint. By passing attacker-controlled executablePath and args into puppeteer.launch(), the code reaches child_process.spawn() outside the sandbox, yielding arbitrary OS command execution as the Flowise process user (root in the official Docker image) and host file disclosure via Chromium's file:// handling. No public exploit is identified at time of analysis, but a vendor security advisory (GHSA-9gvv-qjj3-2p6g) and VulnCheck confirm the flaw; the CVSS 4.0 base score is 9.4.

CRITICAL

9.4

0.4%

67

PoC

CVE-2026-46442

Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key to submit arbitrary JavaScript via POST /api/v1/node-custom-function, which executes inside a NodeVM sandbox that can be escaped to reach the host process and spawn child processes. CVSS 4.0 scores this 9.4 Critical, and publicly available exploit details exist via the GHSA advisory, though no public exploit identified at time of analysis in CISA KEV. The flaw stems from missing route-level authorization combined with a sandbox that Flowise itself documents as a security boundary but which fails to contain malicious payloads.

CRITICAL

9.4

0.3%

67

PoC

CVE-2026-73601

Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTOCOL is set to stdio - to run arbitrary OS commands on the host. By manipulating environment variables (PYTHONWARNINGS, BROWSER) passed to python3 or leveraging node with the root working directory, an attacker bypasses input validation and achieves command execution as the Flowise service account. Reported by VulnCheck with a CVSS 4.0 score of 9.0; no public exploit is identified at time of analysis, though the technique is documented in detail in the vendor advisory.

CRITICAL

9.0

0.6%

66

PoC

CVE-2026-73602

Remote code execution in Flowise before 3.1.3 lets authenticated users escape the vm2 JavaScript sandbox and run arbitrary code on the host. By abusing a moment.js locale-validation weakness, an attacker supplies a forged String object whose match function defeats the path-traversal check, causing Flowise to load and execute an attacker-planted JavaScript file from the document store outside the sandbox. Reported by VulnCheck and fixed by the vendor; no public exploit or CISA KEV listing was identified at time of analysis, though the CVSS 4.0 base score of 9.0 reflects full compromise of confidentiality, integrity, and availability.

CRITICAL

9.0

0.4%

65

PoC

CVE-2026-73487

Remote code execution and SSRF in FlowiseAI Flowise before 3.1.3 stems from a bypassable regex-based Python code validator in the CSV and Airtable Agent nodes, letting attackers smuggle malicious pandas calls through the unauthenticated prediction API via prompt injection. Because the validator blocklists rather than sandboxes, unblocked functions such as pd.read_json() can be abused to exfiltrate local datasets, reach internal services (SSRF), or execute arbitrary code. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the reporting vendor VulnCheck and a GitHub Security Advisory (GHSA-w7x8-q2gp-5cgg) document the issue.

CRITICAL

9.0

0.4%

65

PoC

CVE-2026-73486

Authenticated arbitrary Python code execution in FlowiseAI Flowise before 3.1.3 arises from the CSV Agent node's customReadCSV parameter, whose regex-based validator can be defeated with obfuscation to run attacker-supplied code inside an unsandboxed pyodide runtime with full host access. Any user able to build or edit a chatflow can escalate from application-level access to code execution on the server. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch exists in version 3.1.3.

CRITICAL

9.0

0.3%

65

PoC

CVE-2026-73485

Remote code execution in Flowise before 3.1.3 lets attackers run arbitrary Python on the host by abusing the Airtable Agent node. Crafted chatflow prompts carry obfuscated Python that slips past the pythonCodeValidator blocklist and executes inside an unsandboxed pyodide runtime with full access to the underlying OS. Reported by VulnCheck with a published GHSA advisory; no public exploit code is identified at time of analysis, and it is not listed in CISA KEV.

CRITICAL

9.0

0.3%

65

PoC

CVE-2026-71962

Unauthenticated file exfiltration in Flowise 2.2.4-3.1.4 is possible because the POST /api/v1/openai-assistants-file/download endpoint was incorrectly added to the application's global authentication whitelist, causing all session and API key verification to be skipped unconditionally. Any remote, unauthenticated attacker who can supply valid chatflowId, chatId, and fileName identifiers can retrieve private files from any chatflow on the instance, including those belonging to other workspaces or organizations in a multi-tenant deployment. A public proof-of-concept exploit is available via GitHub, and no KEV listing has been confirmed at time of analysis.

HIGH

8.7

0.4%

64

PoC No patch

CVE-2026-69263

Flowise's patch for CVE-2025-8943 is fully bypassed in versions up to and including 3.1.2, allowing unauthenticated remote code execution on default deployments via the npm_config_yes environment variable. The prior mitigation blocked the -y and --yes flags on npx and denied four specific environment variable names by exact string match, but npm natively reads its configuration from any npm_config_* prefixed variable, making npm_config_yes=true semantically equivalent to --yes. Any attacker who can submit a Custom MCP stdio server configuration - which requires no authentication on default Flowise deployments - can force npx to auto-install and execute an arbitrary package as the Flowise server process. No public exploit code has been identified at time of analysis, though the bypass technique is fully documented in the public GHSA advisory GHSA-xc48-889x-5qmw, making independent weaponization trivial.

HIGH

8.7

0.3%

64

PoC

CVE-2026-73484

Sandbox escape in Flowise's Python code execution layer (pythonCodeValidator.ts) allows authenticated low-privilege users to invoke native Pandas DataFrame methods - to_csv, to_json, pipe, and query - that the validator's denylist fails to restrict. All Flowise deployments prior to version 3.1.3 are vulnerable, with a CVSS 4.0 score of 8.6 reflecting high confidentiality and high integrity impact. A successful attacker can exfiltrate uploaded CSV data or write arbitrary files to the server filesystem; no public exploit has been identified at time of analysis, but the attack primitives are fully documented in the advisory.

HIGH

8.6

0.3%

63

PoC

CVE-2026-67622

Cross-workspace credential theft in Flowise through 3.1.4 exploits a missing workspace-scoped authorization check in the OpenAI Assistants integration, enabling authenticated users to access credentials owned by unrelated workspaces by supplying arbitrary credential UUIDs. The flaw exposes multi-tenant deployments: an attacker with any valid account can enumerate assistant metadata, retrieve file and vector store listings, and write files into victim workspaces without owning or having delegated access to the target workspace. No KEV listing at time of analysis, but a public advisory exists; the product appears to have entered sunset, potentially leaving the vulnerability unpatched.

HIGH

8.5

0.2%

63

PoC No patch

CVE-2026-70476

Cross-tenant billing manipulation in Flowise's enterprise API allows any authenticated user to perform unauthorized Stripe subscription operations against other organizations by supplying an arbitrary victim subscriptionId to the /update-subscription-plan and /update-additional-seats endpoints. All Flowise enterprise deployments running versions prior to 3.1.3 are affected, with impact including unauthorized plan downgrades, seat-count inflation (inflating victim billing), and service disruption across tenants. No public exploit code or CISA KEV listing exists at time of analysis, but the vulnerability is mechanically straightforward given knowledge of a target organization's Stripe subscription identifier.

HIGH

8.3

0.3%

62

PoC

CVE-2026-70474

Cross-workspace OAuth2 credential isolation failure in Flowise prior to version 3.1.3 enables two distinct attack classes: authenticated users can initiate OAuth2 flows against credentials owned by other workspaces, and - more critically - unauthenticated attackers can forge OAuth2 callbacks to overwrite tokens or trigger token refreshes for any credential system-wide by exploiting a whitelist that bypasses all authentication on the /callback and /refresh endpoints. The root cause is that all three OAuth2 handlers query the Credential table by credential ID alone, omitting the workspaceId isolation enforced elsewhere in the codebase. No public exploit has been identified at time of analysis, and the issue is fixed in Flowise 3.1.3.

HIGH

7.6

0.3%

58

PoC

Severity Breakdown

Monthly CVE Trend

Affected Products (7)

Top Risky CVEs