497282 matches found
CVE-2026-58074
A vulnerability allowing a high-privileged user to execute arbitrary code on the server...
CVE-2026-64633
A vulnerability allowing remote unauthenticated code execution on the agent host...
EUVD-2026-52747
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...
CVE-2026-15307
CVE-2026-15307 affects Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups cast the right-hand side of a filter to a GDALRaster, and any value (including untrusted input) is opened for writing or treated as a datasource, enabling a file to be written with an attacker-chosen n...
CVE-2026-15307 Server-side file-write and request forgery via spatial lookups
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...
NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent
NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent
NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent discovered by ? in WordPress Npm flowise versions = 3.1.2...
GHSA-X6VM-W76M-8J7G Flowise: Remote Code Execution Vulnerability in CSVAgent
Summary The CSVAgent node was observed to allow users to write Python code which gets executed via pyodide. The original intent was to allow users to utilise the pandas library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, panda...
Flowise: Remote Code Execution Vulnerability in CSVAgent
Summary The CSVAgent node was observed to allow users to write Python code which gets executed via pyodide. The original intent was to allow users to utilise the pandas library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, panda...
CVE-2026-69256
Flowise CVE-2026-69256 affects the CSVAgent node prior to version 3.1.3. A user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc} and can execute via Pyodide, bypassing a denylist with a pandas.read_pickle payload. An authenticated user who can create/modify a chatflow can add th...
EUVD-2026-52746
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.readpickle could deserialize a pickled...
NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
GHSA-VMV7-4M6C-3CG5 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain 1. Python code injection via base64string = "$base64String" CSVAgent.ts line 161 2. Pyodide js bridge provides access to...
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain 1. Python code injection via base64string = "$base64String" CSVAgent.ts line 161 2. Pyodide js bridge provides access to...
NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
CVE-2026-69255 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...
NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
Summary A sandbox escape vulnerability in executeJavaScriptCode allows any authenticated user to execute arbitrary system commands as root on the Flowise server. The function accepts caller-provided nodeVMOptions that override the default sandbox security settings via JavaScript's spread operator...
CVE-2026-69254 Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...
EUVD-2026-52741
LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the scrip...