171 matches found
jupyterlite-pyodide-kernel (>=0.7.0a0, <=0.7.2), jupyterlite-sphinx (>=0.22.0, <=0.22.1) +5 more potentially affected by CVE-2026-102831 via jupyterlite-core (>=0.7.6, <=0.8.0rc0)
jupyterlite-core PYPI version =0.7.6, =0.7.0a0, =0.22.0, =1.0.1, =4.2.0, =0.3.0, =0.6.0, =0.10.0a0, =0.10.0 Source cves: CVE-2026-102831 Source advisory: OSV:PYSEC-2026-4060...
jupyterlite-pyodide-kernel (>=0.7.0a0, <=0.7.2), jupyterlite-sphinx (>=0.22.0, <=0.22.1) +5 more potentially affected by CVE-2026-102831 via jupyterlite-core (>=0.7.6, <=0.8.0rc0)
jupyterlite-core PYPI version =0.7.6, =0.7.0a0, =0.22.0, =1.0.1, =4.2.0, =0.3.0, =0.6.0, =0.10.0a0, =0.10.0 Source cves: CVE-2026-102831 Source advisory: GHSA-6966-VJJ6-99XV...
jupyterlite-pyodide-kernel (>=0.7.0a0, <=0.7.2), jupyterlite-sphinx (>=0.22.0, <=0.22.1) +5 more potentially affected by CVE-2026-102831 via jupyterlite-core (>=0.7.6, <=0.8.0rc0)
jupyterlite-core PYPI version =0.7.6, =0.7.0a0, =0.22.0, =1.0.1, =4.2.0, =0.3.0, =0.6.0, =0.10.0a0, =0.10.0 Source cves: CVE-2026-102831 Source advisory: OSV:GHSA-6966-VJJ6-99XV...
jupyterlite-pyodide-kernel (>=0.7.0a0, <=0.7.2), jupyterlite-sphinx (>=0.22.0, <=0.22.1) +5 more potentially affected by CVE-2026-102831 via jupyterlite-core (>=0.7.6, <=0.8.0rc0)
jupyterlite-core PYPI version =0.7.6, =0.7.0a0, =0.22.0, =1.0.1, =4.2.0, =0.3.0, =0.6.0, =0.10.0a0, =0.10.0 Source cves: CVE-2026-102831 Source advisory: MEND:CVE-2026-102831...
VulnCheck KEV: CVE-2026-69255
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...
CVE-2026-73486
Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...
CVE-2026-73485
Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the...
CVE-2026-73486 Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV
Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...
EUVD-2026-57802
Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...
CVE-2026-73486 Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV
Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...
CVE-2026-73486
CVE-2026-73486 (Flowise) : Flowise versions before 3.1.3 contain a code injection vulnerability in the CSV Agent node’s customReadCSV parameter. An authenticated attacker can trigger arbitrary Python code execution by bypassing a static regex blocklist used for validation, enabling code execution...
CVE-2026-73486
Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...
CVE-2026-73486 Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV
Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...
CVE-2026-73485 Flowise before 3.1.3 Remote Code Execution via Airtable Agent
Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the...
EUVD-2026-57801
Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the...
CVE-2026-73485 Flowise before 3.1.3 Remote Code Execution via Airtable Agent
Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the...
CVE-2026-73485
Flowise before version 3.1.3 contains a code injection vulnerability in the Airtable Agent node that lets unauthenticated attackers bypass the pythonCodeValidator blocklist via obfuscation and inject malicious Python code. The injected code can run in an unsandboxed pyodide environment with full ...
CVE-2026-73485 Flowise before 3.1.3 Remote Code Execution via Airtable Agent
Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the...
PT-2026-71426
Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...
CVE-2026-73485: Improper Control of Generation of Code
Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the...