58 matches found
EUVD-2026-25278
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, there is a remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas. The user’s input is directly applied to the question parameter within...
Flowise 代码注入漏洞
Flowise is an open-source tool developed by FlowiseAI, designed for easily building LLM applications. Prior versions of Flowise 3.1.0 contained a code injection vulnerability, which was caused by a lack of input validation in the AirtableAgent.ts file. This vulnerability could lead to remote code...
PT-2026-34730
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, there is a remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas. The user’s input is directly applied to the question parameter within...
Flowise 命令注入漏洞
Flowise is an open-source tool developed by FlowiseAI, designed for easily building LLM applications. Prior to Flowise 3.1.0, there was a command injection vulnerability in versions of the tool. This vulnerability stemmed from the lack of proper sandboxing mechanisms in the run method of the...
Incomplete List of Disallowed Inputs
Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the run method of the AirtableAgents class, which evaluates LLM-generated Python scripts in a non-sandboxed environment. An attacker can execute...
Incomplete List of Disallowed Inputs
Overview flowise-ui is a Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the run method of the AirtableAgents class, which evaluates LLM-generated Python scripts in a non-sandboxed environment. An attacker can execute arbitrary code on the server by...
Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
ZDI-CAN-29412: FlowiseAI Flowise AirtableAgent Code Injection Remote Code Execution Vulnerability Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: Flowise - Flowise -- VULNERABILITY DETAILS ------------------------ Version tested: 3.0.13 Installer...
Incomplete List of Disallowed Inputs
Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the run method of the AirtableAgents class, which evaluates LLM-generated Python scripts in a non-sandboxed environment. An attacker can execute arbitrary code on the...
GHSA-V38X-C887-992F Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
ZDI-CAN-29412: FlowiseAI Flowise AirtableAgent Code Injection Remote Code Execution Vulnerability Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: Flowise - Flowise -- VULNERABILITY DETAILS ------------------------ Version tested: 3.0.13 Installer...
PT-2026-34743
Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0 Description An issue exists in the run method of the Airtable Agents class due to insufficient sandboxing when evaluating Python scripts generated by a Large Language Model LLM. An unauthenticated attacker can u...
Arbitrary Code Injection
Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection through the pythonCodeValidator and the Python execution paths in AirtableAgent.ts and CSVAgent.ts. An attacker can supply LLM-generated Python code that smuggles in...
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.
Description Summary “AirtableAgent” is an agent function provided by FlowiseAI that retrieves search results by accessing private datasets from airtable.com. “AirtableAgent” uses Python, along with Pyodide and Pandas, to get and return results. The user’s input is directly applied to the question...
EUVD-2025-12490
Malicious code in bioql PyPI...
EUVD-2025-12489
Malicious code in bioql PyPI...
MAL-2025-19236 Malicious code in eeslint-plugin-airtable (npm)
The package eeslint-plugin-airtable was found to contain malicious code...
Malicious code in eeslint-plugin-airtable (npm)
The package eeslint-plugin-airtable was found to contain malicious code...
Malicious code in create-planning-file-from-airtable (npm)
The package create-planning-file-from-airtable was found to contain malicious code...
MAL-2025-17662 Malicious code in create-planning-file-from-airtable (npm)
The package create-planning-file-from-airtable was found to contain malicious code...
Malicious code in airtable-blocks-internal (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a563df0782e092825d76e13be3d7f6df53a01cb0afe716bdc6a1bbe63692f9d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-3815 Malicious code in airtable-blocks-internal (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a563df0782e092825d76e13be3d7f6df53a01cb0afe716bdc6a1bbe63692f9d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...