1253 matches found
Incomplete List of Disallowed Inputs
Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the validatePythonCodeForDataFrame process. An attacker can execute arbitrary operating system commands by submitting specially crafted Python code containing Unicod...
GHSA-X6VM-W76M-8J7G Flowise: Remote Code Execution Vulnerability in CSVAgent
Summary The CSVAgent node was observed to allow users to write Python code which gets executed via pyodide. The original intent was to allow users to utilise the pandas library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, panda...
Arbitrary Code Injection
Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via unsanitized string interpolation in the CSVAgent process. An attacker can execute arbitrary operating system commands, read sensitive files, steal credentials, an...
CVE-2026-69255 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...
CVE-2026-69255
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...
Code Injection
datamodel-code-generator is vulnerable to Code Injection. The vulnerability is due to insufficient validation of x-python-type values from attacker-controlled JSON Schema content before inserting them into generated Python field annotations, which allows an attacker to execute arbitrary Python co...
Aeon load_human_activity_segmentation_datasets Code Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
CVE-2026-54654
datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...
CVE-2026-54621
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...
CVE-2026-54621 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...
CVE-2026-54621 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...
EUVD-2026-50071
datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...
CVE-2026-55415: Improper Control of Generation of Code
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema...
CVE-2026-54621: Improper Control of Generation of Code
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...
CVE-2026-54656: Improper Control of Generation of Code
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in...
VulnCheck KEV: CVE-2026-59821
LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to creat...
Exploit for Code Injection in Kidocode Crawl4Ai
CVE-2026-26216 — Crawl4AI unauthenticated RCE via hooks GHS...
Code Injection
LiteLLM is vulnerable to Code Injection. The vulnerability is due to insufficient sandboxing and validation of custom Python code submitted through the Custom Code Guardrails create and update paths, which allows a privileged attacker with guardrail management access to execute arbitrary Python...
[SECURITY] Fedora 44 Update: python-black-26.5.1-1.fc44
Black is the uncompromising Python code formatter. By using it, you agree to cease control over minutiae of hand-formatting. In return, Black gives you speed, determinism, and freedom from pycodestyle nagging about formatting. You will save time and mental energy for more important matters...