NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

CVE-2026-69254

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...

EUVD-2026-52742

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...

CVE-2026-69251

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...

Flowise Sandbox Escape to RCE

============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: Luke Jahnke and Alex Brown Affects: FlowiseAI/Flowise 3.1.1, FlowiseAI/nodevm...

GHSA-WG86-R78F-74MP Flowise Sandbox Escape to RCE

============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: Luke Jahnke and Alex Brown Affects: FlowiseAI/Flowise 3.1.1, FlowiseAI/nodevm...

CLSA-2026-1785468077 TuxCare security update for protobufjs (7 CVEs)

TuxCare rebuilt protobufjs to address 7 CVEs. Fixed in 5.0.0-tuxcare.2...

CLSA-2026-1780534264 TuxCare security update for jspdf (12 CVEs)

TuxCare rebuilt jspdf to address 12 CVEs. Fixed in 2.5.1-tuxcare.1...

CLSA-2026-1776645371 TuxCare security update for serialize-javascript (1 CVE)

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 6.0.2-tuxcare.2...

CLSA-2026-1776645372 TuxCare security update for serialize-javascript (1 CVE)

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 5.0.1-tuxcare.2...

CLSA-2026-1776213251 TuxCare security update for serialize-javascript (3 CVEs)

TuxCare rebuilt serialize-javascript to address 3 CVEs. Fixed in 2.1.2-tuxcare.1...

CLSA-2026-1774916712 TuxCare security update for serialize-javascript (1 CVE)

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 4.0.0-tuxcare.1...

CLSA-2026-1774916711 TuxCare security update for serialize-javascript (1 CVE)

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 5.0.1-tuxcare.1...

CLSA-2026-1774916713 TuxCare security update for serialize-javascript (1 CVE)

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 3.1.0-tuxcare.1...

CLSA-2026-1774225180 TuxCare security update for uglify-js (2 CVEs)

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 1.3.5-tuxcare.1...

CLSA-2026-1774398069 TuxCare security update for serialize-javascript (2 CVEs)

TuxCare rebuilt serialize-javascript to address 2 CVEs. Fixed in 1.9.1-tuxcare.1...

CLSA-2026-1773620213 TuxCare security update for jspdf (3 CVEs)

TuxCare rebuilt jspdf to address 3 CVEs. Fixed in 2.5.2-tuxcare.7...

CLSA-2026-1773447385 TuxCare security update for serialize-javascript (1 CVE)

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 6.0.2-tuxcare.1...

Arbitrary Code Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection via the additionalConfig input to the TypeORM DataSource class, which allows arbitrary options to be set. An attacker can achieve arbitrary code execution on the server by uploading...