SB20260727343 - Multiple vulnerabilities in Flowise

Security Bulletin ID SB20260727343

CSH Severity

High

Patch available

YES

Number of vulnerabilities 35

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 35 vulnerabilities.

1) Code Injection (CVE-ID: N/A)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary system commands.

The vulnerability exists due to improper control of code generation in executeJavaScriptCode() when processing caller-provided nodeVMOptions in a NodeVM sandbox. A remote user can supply crafted JavaScript and override sandbox module restrictions to execute arbitrary system commands.

Exploitation requires a valid API key and occurs through the node-custom-function execution path. The executed commands run with root privileges in the documented deployment context.

2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to read, modify, or delete victim vector stores and files, and cause unauthorized use of another workspace's OpenAI key.

The vulnerability exists due to improper authorization in the /api/v1/openai-assistants-vector-store endpoint when processing a client-supplied credential identifier. A remote user can send a crafted request with another workspace's credential ID to read, modify, or delete victim vector stores and files, and cause unauthorized use of another workspace's OpenAI key.

Exploitation requires assistants-related permissions and knowledge of a credential ID from another workspace.

3) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose OAuth2 credential metadata across workspaces.

The vulnerability exists due to improper access control in the OAuth2 authorize endpoint when handling credential authorization requests by credential ID without workspace scoping. A remote user can send an authorization request for another workspace's credential to disclose OAuth2 credential metadata across workspaces.

The returned authorization data can expose values such as the client identifier, requested scope, and redirect URI.

4) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to overwrite OAuth2 tokens in any credential.

The vulnerability exists due to improper access control in the OAuth2 callback endpoint when processing callback requests with the state parameter used as a credential lookup key and no workspace scoping. A remote user can forge an OAuth2 callback request to overwrite OAuth2 tokens in any credential.

The callback endpoint is whitelisted from authentication, and exploitation requires control of an OAuth2 provider response or interception of the OAuth2 flow.

5) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to obtain fresh OAuth2 access tokens for any credential.

The vulnerability exists due to improper access control in the OAuth2 refresh endpoint when processing token refresh requests for credentials looked up by ID without workspace scoping. A remote user can send a token refresh request for another credential to obtain fresh OAuth2 access tokens for any credential.

The refresh endpoint is whitelisted from authentication, and the server returns the refreshed access token in the response body.

6) Eval Injection (CVE-ID: N/A)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the AgentAsTool node and related JavaScript execution path when handling a crafted baseURL value injected into generated code executed with the insecure vm2 sandbox. A remote user can inject arbitrary JavaScript through the baseURL setting to execute arbitrary code.

Exploitation requires valid access to a Flowise instance and affects code paths that still invoke JavaScript execution with useSandbox set to false.

7) Code Injection (CVE-ID: N/A)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper control of code generation in the CSVAgent node when processing a user-supplied customReadCSVFunc value. A remote user can supply crafted pandas.read_pickle() input to execute arbitrary code.

Exploitation requires access to create or modify a chatflow that uses the CSV Agent node, after which the vulnerable chatflow can be triggered via a prediction request.

8) Eval Injection (CVE-ID: N/A)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the vm2-based JavaScript sandbox used by the custom function agent flow node and custom tool when executing user-supplied JavaScript. A remote user can submit crafted JavaScript that escapes the sandbox to execute arbitrary code.

Exploitation requires authentication and affects instances using the default vm2 sandbox.

9) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to access internal services and disclose sensitive information.

The vulnerability exists due to incorrect normalization of IPv4-mapped IPv6 addresses in the http security module when validating resolved host addresses against the deny list. A remote user can control DNS resolution for a hostname and provide a crafted AAAA record to access internal services and disclose sensitive information.

The issue affects IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254, causing IPv4 CIDR deny rules to be skipped because of an ipv6 versus ipv4 kind mismatch.

10) Eval Injection (CVE-ID: N/A)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the Custom MCP node when spawning stdio-based MCP processes with user-controlled environment variables and commands. A remote user can supply a crafted Custom MCP configuration and trigger action refresh to execute arbitrary code.

Only deployments using the stdio Custom MCP protocol are vulnerable, and the issue can be triggered when refreshing the available actions for the Custom MCP node.

11) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2025-8943) Exploited

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to incomplete list of disallowed inputs in packages/components/nodes/tools/MCP/core.ts when processing MCP server environment variables for child process execution. A remote user can set npm_config_yes=true in a crafted MCP server configuration to execute arbitrary code.

This issue can be triggered even when CUSTOM_MCP_SECURITY_CHECK=true is enabled.

12) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify execution records.

The vulnerability exists due to missing authorization in the PUT /api/v1/executions/:id endpoint when handling execution update requests. A remote user can send a crafted PUT request with a valid API key to modify execution records.

This issue affects authenticated users regardless of their assigned execution permissions and is limited to execution records in their workspace.

13) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to missing authorization in GET /api/v1/upsert-history when handling requests for upsert history data. A remote user can send a request to the endpoint to disclose sensitive information.

The response may include server-wide upsert history and sensitive configuration details such as vector store endpoint URLs, collection names, and schema-related parameters.

14) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to perform server-side request forgery and disclose sensitive information.

The vulnerability exists due to authorization bypass through user-controlled key in the OAuth2 token refresh endpoint in dist/routes/oauth2/index.js when handling refresh requests for a user-supplied credential ID and issuing a server-side POST request to a credential-controlled accessTokenUrl. A remote privileged user can send a crafted refresh request referencing a valid credential ID to perform server-side request forgery and disclose sensitive information.

The endpoint reflects the full remote response body to the caller through tokenInfo, and exploitation can expose OAuth2 client secrets and refresh tokens if an attacker-controlled OAuth2 credential has been configured.

15) Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVE-ID: N/A)

CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to inject arbitrary properties into the flow execution context.

The vulnerability exists due to improperly controlled modification of dynamically-determined object attributes in the prediction API overrideConfig handling when processing unauthenticated POST requests to /api/v1/prediction/:id. A remote attacker can send a specially crafted request with an overrideConfig object to inject arbitrary properties into the flow execution context.

Injected properties may overwrite chatId, sessionId, or chatHistory values and may be resolved through $flow.* template variables in public chatflows.

16) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to manipulate another organization's Stripe subscription.

The vulnerability exists due to authorization bypass through a user-controlled key in the organization billing endpoints when processing attacker-supplied subscription identifiers. A remote attacker can send crafted requests with a victim organization's subscriptionId to manipulate another organization's Stripe subscription.

This affects cross-tenant billing operations including subscription plan changes and seat quantity updates.

17) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper authorization in the /api/v1/node-custom-function custom function endpoint when injecting $vars into the code execution sandbox. A remote user can call the endpoint and access workspace variables, including runtime values resolved from server environment variables, to disclose sensitive information.

The issue bypasses the variables:view permission boundary, and runtime variables of type runtime are resolved from process.env.

18) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and access connected third-party services.

The vulnerability exists due to improper access control in the OAuth2 token refresh endpoint when handling unauthenticated refresh requests for a credential ID. A remote attacker can send a crafted POST request to obtain a refreshed access token and access connected third-party services.

Exploitation requires knowledge of a credential ID, which may be obtained through enumeration or other information leaks.

19) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper input validation in the run method of the Airtable_Agents class when processing prompts for a chatflow using the Airtable Agent node. A remote user can send a crafted prompt or supply attacker-controlled model output to execute arbitrary code.

Exploitation occurs because validated Python code is executed in an unsandboxed pyodide environment in the context of the user running the server.

20) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information in the GET /api/v1/credentials/:id endpoint when returning decrypted credential data in API responses. A remote user can send a request to retrieve a credential by ID to disclose sensitive information.

The issue affects users with the credentials:view permission and exposes plaintext secret values stored in credential fields defined as type: 'string'.

21) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper access control in the NodeVM sandbox allowlist and /api/v1/node-custom-function endpoint when processing authenticated user-supplied JavaScript that loads puppeteer. A remote user can submit crafted JavaScript that invokes puppeteer's launch() API with attacker-controlled executablePath and arguments to execute arbitrary code.

The code runs as the Flowise process user, which is root in the official Docker image.

22) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the NodeVM sandbox allowlist and /api/v1/node-custom-function endpoint when processing authenticated user-supplied JavaScript that loads puppeteer. A remote user can submit crafted JavaScript that uses Chromium file:// navigation through puppeteer to disclose sensitive information.

The issue allows reading files accessible to the Flowise process user and returning their contents in the API response.

23) Incomplete List of Disallowed Inputs (CVE-ID: N/A)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information and write arbitrary files to the server filesystem.

The vulnerability exists due to incomplete list of disallowed inputs in pythonCodeValidator.ts when validating Python code generated for the CSVAgent. A remote user can prompt the LLM to generate allowed Pandas DataFrame methods such as to_csv() or to_json() to disclose sensitive information and write arbitrary files to the server filesystem.

The issue affects Pyodide-based execution and requires access to interact with a CSVAgent or upload a CSV.

24) Code Injection (CVE-ID: N/A)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper control of code generation in the CSVAgent.ts CSV Agent component when processing a crafted CSV data URI. A remote user can inject Python code into the interpolated base64_string value to execute arbitrary code.

The issue can be leveraged through the Pyodide js bridge to reach the host Node.js process, and the supplied payload cannot contain commas because the input is split on commas.

25) Eval Injection (CVE-ID: N/A)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the CSVAgent component when processing a crafted csvFile data URI. A remote user can plant a crafted chatflow and trigger prediction execution to execute arbitrary code.

Exploitation requires the ability to create or update chatflows or agentflows, and the resulting malicious flow can then be triggered through the public prediction endpoint when the chatflow has no API key set.

26) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper access control in the SQLite Record Manager node when processing user-supplied additional configuration. A remote user can override the database path to write a crafted SQLite database to an arbitrary file and trigger command execution to execute arbitrary code.

Exploitation requires an authenticated user and affects instances using the published Docker image where the process runs as root. A separate Puppeteer launch is used to read the malicious file from /etc/chromium/*.conf.

27) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: N/A)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input sanitization in the run method of the CSV_Agents class when constructing an LLM prompt from untrusted data and executing LLM-generated Python code. A remote attacker can send a crafted prompt injection payload to cause the LLM to produce malicious Python code and execute arbitrary code.

Exploitation requires a chatflow using the CSV Agent node, and the generated Python code is executed in an unsandboxed pyodide environment.

28) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the GET /api/v1/organization/customer-default-source endpoint when handling requests with a user-controlled customerId parameter. A remote user can modify the customerId parameter in a crafted request to disclose sensitive information.

The endpoint requires a valid session or token, but it does not verify whether the requesting user is authorized to access the specified customer record. Predictable customer identifiers may enable enumeration of other customers' data.

29) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper input validation in the run method of the CSV_Agents class when processing a crafted chatflow using a CSV Agent node with a malicious customReadCSV value. A remote user can send a crafted chatflow and trigger internal prediction to execute arbitrary code.

Python code executes in an unsandboxed pyodide environment in the context of the user running the server.

30) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to delete flow resources outside their intended permission scope.

The vulnerability exists due to improper access control in DELETE /api/v1/chatflows/:id when handling delete requests for flow records. A remote user can send a delete request for a flow id associated with the other flow type to delete flow resources outside their intended permission scope.

This issue breaks the intended RBAC separation between Chatflows and Agentflows within the same workspace.

31) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information and delete files across workspaces within the same organization.

The vulnerability exists due to missing authorization in the /api/v1/files endpoint when handling GET and DELETE requests with an authenticated API key. A remote user can send crafted requests to list files from other workspaces and delete files by supplying a user-controlled path to disclose sensitive information and delete files across workspaces within the same organization.

The route is protected only by the feat:files feature gate and does not enforce workspace-specific permission checks, which breaks workspace isolation within the organization.

32) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to write arbitrary files.

The vulnerability exists due to path traversal in the S3 Directory document loader when processing attacker-controlled S3 object keys. A remote user can supply crafted S3 object keys containing traversal sequences to write arbitrary files.

Exploitation requires the `documentStores:preview-process` permission and can be performed by pointing the loader to an attacker-controlled S3-compatible endpoint via `serverUrl`.

33) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and access internal network resources.

The vulnerability exists due to improper input validation in validatePythonCodeForDataFrame() used by the CSV Agent and Airtable Agent nodes when processing prompt-injection-controlled Python code from the prediction API. A remote attacker can send a specially crafted prediction request to disclose sensitive information and access internal network resources.

The issue can be reached through the unauthenticated prediction endpoint and requires a chatflow that includes a CSV Agent or Airtable Agent with loaded data.

34) Incomplete List of Disallowed Inputs (CVE-ID: N/A)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to incomplete list of disallowed inputs in the Pyodide code validator in packages/components/src/pythonCodeValidator.ts when processing attacker-controlled Python code for CSV_Agent or Airtable_Agent. A remote attacker can supply Python code using Unicode homoglyph identifiers to bypass the blacklist and execute arbitrary code.

Unauthenticated exploitation is possible through public chatflows, and the issue affects both LLM-generated Python code and the customReadCSV path.

35) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper access control in TypeORM DataSource configuration handling in record manager and agent memory nodes when processing user-supplied additionalConfig options. A remote user can supply crafted DataSource options that load attacker-controlled local JavaScript files to execute arbitrary code.

Exploitation requires valid authentication and the ability to configure a flow node that exposes the additionalConfig input.

Remediation

Install update from vendor's website.

SB20260727343 - Multiple vulnerabilities in Flowise

Breakdown by Severity

Description

Remediation

References

Please verify you're human