2571 matches found
MAL-2026-12182 Malicious code in json-validator-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 255dbc17164a6243a92bab0b4d71132efad3028b53e73d7d2924a1d7ccd1e8cf The package advertises itself as a JSON/XML validator but lib/core.js contains a multi-stage dropper triggered on any call to the public API...
CVE-2026-69264
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...
NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This...
NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
GHSA-52FH-8V99-63C2 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This...
CVE-2026-70470 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...
CVE-2026-70470
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...
CVE-2026-70470 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...
CVE-2026-70470
Flowise CVE-2026-70470: Before version 3.1.3, the validatePythonCodeForDataFrame checker in Flowise allows bypass via Unicode homoglyphs in identifiers, circumventing the ASCII word-boundary blacklist and enabling arbitrary Python execution inside Pyodide with potential full OS command execution ...
EUVD-2026-52811
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...
CVE-2026-70470 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...
CVE-2026-69264 Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...
CLSA-2026-1784769499 TuxCare security update for validator (1 CVE)
TuxCare rebuilt validator to address 1 CVE. Fixed in 8.2.0-tuxcare.3...
CLSA-2026-1784596282 TuxCare security update for ajv (1 CVE)
TuxCare rebuilt ajv to address 1 CVE. Fixed in 6.10.0-tuxcare.1...
CLSA-2026-1779151625 TuxCare security update for ajv (2 CVEs)
TuxCare rebuilt ajv to address 2 CVEs. Fixed in 6.4.0-tuxcare.1...
CLSA-2026-1777163882 TuxCare security update for validator (2 CVEs)
TuxCare rebuilt validator to address 2 CVEs. Fixed in 10.11.0-tuxcare.3...
CLSA-2026-1776818196 TuxCare security update for ajv (1 CVE)
TuxCare rebuilt ajv to address 1 CVE. Fixed in 5.5.2-tuxcare.4...