Arbitrary Command Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Command Injection via the nodevm execution environment when integrated modules such as Puppeteer or Playwright are used with attacker-controlled browser binary paths and parameters. An authenticat...

GHSA-R4HH-PCGX-J5R2 Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages

Flowise v3.0.1 3.0.8 and all versions after with 'ALLOWBUILTINDEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules Puppeteer and Playwright within the nodevm execution environment. An authenticated attacker...

Arbitrary Command Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Command Injection via the nodevm execution environment when integrated modules such as Puppeteer or Playwright are used with attacker-controlled browser binary paths and parameters...

Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages

Flowise v3.0.1 3.0.8 and all versions after with 'ALLOWBUILTINDEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules Puppeteer and Playwright within the nodevm execution environment. An authenticated attacker...

EUVD-2025-34455

Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages...

CVE-2025-34267

Flowise v3.0.1 3.0.8 and all versions after with 'ALLOWBUILTINDEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules Puppeteer and Playwright within the nodevm execution environment. An authenticated attacker...

CVE-2025-34267 Flowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright Packages

Flowise v3.0.1 3.0.8 and all versions after with 'ALLOWBUILTINDEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules Puppeteer and Playwright within the nodevm execution environment. An authenticated attacker...

CVE-2025-34267 Flowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright Packages

Flowise v3.0.1 3.0.8 and all versions after with 'ALLOWBUILTINDEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules Puppeteer and Playwright within the nodevm execution environment. An authenticated attacker...

CVE-2025-34267

CVE-2025-34267 affects Flowise v3.0.1

CVE-2025-34267 Flowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright Packages

Flowise v3.0.1 3.0.8 and all versions after with 'ALLOWBUILTINDEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules Puppeteer and Playwright within the nodevm execution environment. An authenticated attacker...

GHSA-7MVR-C777-76HP Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate

Summary Use of curl with the -k or --insecure flag in installer scripts allows attackers to deliver arbitrary executables via Man-in-the-Middle MitM attacks. This can lead to full system compromise, as the downloaded files are installed as privileged applications. Details The following scripts in...

Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate

Summary Use of curl with the -k or --insecure flag in installer scripts allows attackers to deliver arbitrary executables via Man-in-the-Middle MitM attacks. This can lead to full system compromise, as the downloaded files are installed as privileged applications. Details The following scripts in...

Improper Verification of Cryptographic Signature

Overview playwright-core is an A high-level API to automate web browsers Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via improper verification of cryptographic signatures during package installation. An attacker can impersonate trusted...

CVE-2025-59288

Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network...

CVE-2025-59288 Playwright Spoofing Vulnerability

...

CVE-2025-59288 Playwright Spoofing Vulnerability

...

CVE-2025-59288

CVE-2025-59288 – Playwright spoofing vulnerability : The issue arises from improper verification of cryptographic signatures in GitHub downloads for the Microsoft Playwright Node.js package, enabling an attacker on an adjacent network to spoof content. Affected product: Microsoft Playwright (Node...

Microsoft Playwright Node.js Package < 1.55.1 Spoofing (CVE-2025-59288)

The version of the Microsoft Playwright Node.js Package installed on the remote host is prior to 1.55.1. It is, therefore, affected by a spoofing vulnerability: - Improper verification of cryptographic signature in GitHub allows an unauthorized attacker to perform spoofing over an adjacent networ...

Microsoft Playwright 数据伪造问题漏洞

Microsoft Playwright is an automation framework from Microsoft Corporation USA. Microsoft Playwright suffers from a Data Forgery Issue vulnerability, which can be exploited by an attacker to perform spoofing attacks...

KLA89275 SUI vulnerability in Microsoft Open Source Software

A spoofing vulnerability was found in Microsoft Open Source Software. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2025-59288 CVE list CVE-2025-59288 high Solution Install necessary updates from the KB section, that are listed in your Windows...