12 matches found
CVE-2026-91938
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...
EUVD-2026-78796
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...
CVE-2026-91938 Flowise before 3.1.4 Server-Side Request Forgery via document loaders
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...
CVE-2026-91938: Server-Side Request Forgery (SSRF)
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...
PT-2026-92058
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...
Malicious code in cheerio-tool (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d51a2885f4eaff732d1ef7ab065b04d21c59263b1212d5b92b92c87914ef879 cheerio-tool typosquats the popular cheerio HTML parser README claims 'Cheerio Tool utility helpers', keywords are 'lodash','utilities', and index.js...
Malicious code in cheerio-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8345a6f4f7a1b718b4a830c532eb9dd1ad2d6dfcc7025f61dc440db597b39db0 The package cheerio-core was found to contain malicious code. Source: ghsa-malware bc9d76c466fb57f9a35285e94c0e9819bf5fc9e6a61d44e97e14ef0c2c4b96d0 A...
Malicious Package
Overview cheerio-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-671 Malicious code in cheerio-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8345a6f4f7a1b718b4a830c532eb9dd1ad2d6dfcc7025f61dc440db597b39db0 The package cheerio-core was found to contain malicious code. Source: ghsa-malware bc9d76c466fb57f9a35285e94c0e9819bf5fc9e6a61d44e97e14ef0c2c4b96d0 A...
Malicious code in cheerio-ajax (npm)
The package cheerio-ajax was found to contain malicious code...
