flowise (>=1.6.1, <=2.2.8) potentially affected by unknown CVE via flowise-components (>=1.8.6, <=2.2.8)

flowise-components NPM version =1.8.6, =1.6.1, =2.2.8 Source cves: unknown CVE Source advisory: SNYK:JS-FLOWISECOMPONENTS-12818395...

@proompter/demo-next (>=0.0.16, <=0.0.19), @proompter/flowise (>=1.4.13, <=1.4.14) +2 more potentially affected by CVE-2025-8943 via flowise-components (>=1.3.4, <=3.1.4)

flowise-components NPM version =1.3.4, =0.0.16, =1.4.13, =0.0.1, =1.0.0, =3.1.4 Source cves: CVE-2025-8943 Source advisory: SNYK:JS-FLOWISECOMPONENTS-11953677...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection due to the unsafe implementation of a dynamic Function constructor. An attacker can execute arbitrary JavaScript code on the server by sending a crafted POST request...

Command Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Command Injection via the CustomMCP class. An attacker can gain unauthorized remote access and execute arbitrary operating system commands by sending crafted requests over the network. This i...

SQL Injection

flowise-components is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of the tableName parameter in PostgresVectorStore, which allows an attacker to execute arbitrary SQL commands...