CVE-2026-41242

CVE-2026-41242 — Inyección de código en protobuf.js a RCE CVSS 9.4 Crítico | Inyección de código CWE-94 Resumen protobuf.js npm: protobufjs versiones ≤ 7.5.4 y ≤ 8.0.0 tienen una vulnerabilidad de ejecución de código arbitrario a través de nombres de tipo en el esquema protobuf. El módulo...

CVE-2025-59528

CVE-2025-59528: Flowise CustomMCP Prueba de Concepto de Ejecución Remota de Código Una prueba de concepto en Go para CVE-2025-59528 dirigida a versiones de Flowise = 3.0.5. Resumen Flowise permite la ejecución de JavaScript no validada a través de la configuración del nodo CustomMCP. La aplicació...

CVE-2025-59528-POC

CVE-2025-59528 - Ejecución Remota de Código en FlowiseAI CustomMCP CVSS 10.0 Crítico | RCE Ciego | FlowiseAI Flowise = 2.2.7-patch.1 y 3.0.6 Resumen Una vulnerabilidad crítica de ejecución remota de código en el nodo CustomMCP de FlowiseAI Flowise. La función convertToValidJSONString pasa la...

CVE-2025-59528

CVE-2025-59528 – Flowise CustomMCP 节点远程代码执行（PoC） 概述 本仓库包含了证明 CVE-2025-59528 在 Flowise v3.0.5 中存在的概念验证代码。 该漏洞存在于 customMCP 节点中，用户提供的 mcpServerConfig 输入在处理时，会通过 Function 构造函数进行不安全求值，从而导致 JavaScript 代码执行。 受影响版本 受影响| 修复版本 ---|--- 3.0.5| 3.0.6 影响 经过身份验证的用户可能能够在服务器上执行任意 JavaScript，进而可能导致远程代码执行。 安装...

EUVD-2026-74280

n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution...

CVE-2026-86076

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named sanitize could rebind the sanitizer and reach the Function...

CVE-2026-86076 n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named sanitize could rebind the sanitizer and reach the Function...

CVE-2026-86076

n8n , an open-source workflow automation platform, is affected by an expression sandbox escape in the Editor-UI. Prior to versions 1.123.76 , 2.37.7 , and 2.38.2 , the expression compiler sanitizer (the PrototypeSanitizer hook in packages/workflow/src/expression-sandboxing.ts) resolved through dy...

CVE-2025-59528.yaml

CVE-2025-59528.yaml Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses...

CVE-2025-58434-59528

CVE-2025-58434 + CVE-2025-59528 Cadena de explotación para dos vulnerabilidades que afectan Flowise = 3.0.5. Vulnerabilidades CVE-2025-58434 — Toma de Cuenta No Autenticada El endpoint de olvido de contraseña devuelve un token de restablecimiento de contraseña válido en la respuesta de la API sin...

CVE-2026-40897

CVE-2026-40897 Ejecución Remota de Código en el Analizador de Expresiones de Math.js ★ CVE-2026-40897 Ejecución Remota de Código en Math.js PoC ★ https://github.com/user-attachments/assets/8c394039-f00a-4875-991a-fb5f40bc6898 Resumen CVE-2026-40897 es una vulnerabilidad de Omisión de Sandbox que...

React2Shell-CVE-2025-55182-The-Deserialization-Bug-That-Broke-the-Web

React2Shell（CVE-2025-55182）：打破网络的反序列化漏洞 ⚡ React2Shell，CVE-2025-55182，RCE漏洞：对React服务器组件中不安全的反序列化缺陷的深入分析，该缺陷能够在默认的React/Next.js环境中实现未经身份验证的远程代码执行。 ⏩ 快速总结 React2Shell（CVE-2025-55182）是一个严重远程代码执行（RCE）漏洞，影响React 19.x中的React服务器组件（RSC）以及Next.js等框架。该漏洞源于对“Flight”协议块的 不安全反序列化，允许攻击者注入恶意结构，这些结构会解析为Function构造...

PT-2026-88507

Impact The expression compiler's sanitizer resolved through a dynamically-scoped this, so a class field named sanitize rebound it and reached the Function constructor. On the backend, any expression author could run code in the n8n process; in the editor preview, a member's expression could run a...

CVE-2026-85610

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to loa...

CVE-2026-85610

OpenPanel before version 2.3.0 is vulnerable to Remote Code Execution via chart formula expressions. The root cause is improper validation of these expressions, which allows authenticated project members with read access to recover the native JavaScript Function constructor through mathjs matrix ...

CVE-2026-85610 OpenPanel before 2.3.0 Remote Code Execution via chart formulas

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to loa...

PT-2026-85506

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to loa...

EUVD-2026-56923

Faker: helpers.fake exploitable into arbritary code execution...

Malicious code in express-session-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e94450f5541b39d8310a8b640dee027b0970db6e7cf724352726d49393bfb77 The package advertises itself as an Express session middleware but on module load unconditionally invokes an initPlugin routine in index.js that...

MAL-2026-14303 Malicious code in x6842179305 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca4cf1d317cc7c96f8007c983999e18529f2cb8dea5514dcc68f704c7bda5638 Package x6842179305 ships a main entry 1.js that invokes the Function constructor over a custom-encoded, keyed/XOR-decoded byte buffer, causing an...