73827 matches found
CVE-2026-10032 Arbitrary JavaScript Execution via openUrl in @a2ui/web_core
The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...
CVE-2026-10032
The CVE-2026-10032 issue involves the openUrl function in @a2ui/web_core, which passes an agent-controlled URL directly to window.open() without URI scheme validation. A malicious actor can supply a javascript: URI as the url argument for a Button component’s functionCall action, allowing arbitra...
CVE-2026-10032
The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...
CVE-2026-10032 Arbitrary JavaScript Execution via openUrl in @a2ui/web_core
The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...
NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
CVE-2026-69254
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...
EUVD-2026-52742
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...
CVE-2026-69251
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...
Flowise Sandbox Escape to RCE
============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: Luke Jahnke and Alex Brown Affects: FlowiseAI/Flowise 3.1.1, FlowiseAI/nodevm...
GHSA-WG86-R78F-74MP Flowise Sandbox Escape to RCE
============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: Luke Jahnke and Alex Brown Affects: FlowiseAI/Flowise 3.1.1, FlowiseAI/nodevm...
CLSA-2026-1785468077 TuxCare security update for protobufjs (7 CVEs)
TuxCare rebuilt protobufjs to address 7 CVEs. Fixed in 5.0.0-tuxcare.2...
CLSA-2026-1780534264 TuxCare security update for jspdf (12 CVEs)
TuxCare rebuilt jspdf to address 12 CVEs. Fixed in 2.5.1-tuxcare.1...
CLSA-2026-1776645371 TuxCare security update for serialize-javascript (1 CVE)
TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 6.0.2-tuxcare.2...
CLSA-2026-1776645372 TuxCare security update for serialize-javascript (1 CVE)
TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 5.0.1-tuxcare.2...
CLSA-2026-1776213251 TuxCare security update for serialize-javascript (3 CVEs)
TuxCare rebuilt serialize-javascript to address 3 CVEs. Fixed in 2.1.2-tuxcare.1...
CLSA-2026-1774916713 TuxCare security update for serialize-javascript (1 CVE)
TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 3.1.0-tuxcare.1...
CLSA-2026-1774916712 TuxCare security update for serialize-javascript (1 CVE)
TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 4.0.0-tuxcare.1...