Flowise 命令注入漏洞

Flowise is an open-source tool developed by FlowiseAI, designed for easily building LLM applications. Prior to Flowise 3.1.0, there was a command injection vulnerability in versions of the tool. This vulnerability stemmed from the lack of proper sandboxing mechanisms in the run method of the...

Flowise 代码注入漏洞

Flowise is an open-source tool developed by FlowiseAI, designed for easily building LLM applications. Prior versions of Flowise 3.1.0 contained a code injection vulnerability, which was caused by a lack of input validation in the AirtableAgent.ts file. This vulnerability could lead to remote code...

GHSA-V38X-C887-992F Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability

ZDI-CAN-29412: FlowiseAI Flowise AirtableAgent Code Injection Remote Code Execution Vulnerability Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: Flowise - Flowise -- VULNERABILITY DETAILS ------------------------ Version tested: 3.0.13 Installer...

Incomplete List of Disallowed Inputs

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the run method of the AirtableAgents class, which evaluates LLM-generated Python scripts in a non-sandboxed environment. An attacker can execute arbitrary code on the...

Incomplete List of Disallowed Inputs

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the run method of the AirtableAgents class, which evaluates LLM-generated Python scripts in a non-sandboxed environment. An attacker can execute...

Incomplete List of Disallowed Inputs

Overview flowise-ui is a Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the run method of the AirtableAgents class, which evaluates LLM-generated Python scripts in a non-sandboxed environment. An attacker can execute arbitrary code on the server by...

Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability

ZDI-CAN-29412: FlowiseAI Flowise AirtableAgent Code Injection Remote Code Execution Vulnerability Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: Flowise - Flowise -- VULNERABILITY DETAILS ------------------------ Version tested: 3.0.13 Installer...

PT-2026-34743

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0 Description An issue exists in the run method of the Airtable Agents class due to insufficient sandboxing when evaluating Python scripts generated by a Large Language Model LLM. An unauthenticated attacker can u...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection through the pythonCodeValidator and the Python execution paths in AirtableAgent.ts and CSVAgent.ts. An attacker can supply LLM-generated Python code that smuggles in...

Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.

Description Summary “AirtableAgent” is an agent function provided by FlowiseAI that retrieves search results by accessing private datasets from airtable.com. “AirtableAgent” uses Python, along with Pyodide and Pandas, to get and return results. The user’s input is directly applied to the question...

Airtable: undisclosed vulnerability (ZAI-2026-DCRUFL)

Not disclosed. Details are not yet publicly disclosed...

EUVD-2025-12490

Malicious code in bioql PyPI...

EUVD-2025-12489

Malicious code in bioql PyPI...

Malicious code in create-planning-file-from-airtable (npm)

The package create-planning-file-from-airtable was found to contain malicious code...

Malicious code in eeslint-plugin-airtable (npm)

The package eeslint-plugin-airtable was found to contain malicious code...

MAL-2025-19236 Malicious code in eeslint-plugin-airtable (npm)

The package eeslint-plugin-airtable was found to contain malicious code...

MAL-2025-17662 Malicious code in create-planning-file-from-airtable (npm)

The package create-planning-file-from-airtable was found to contain malicious code...

Malicious code in airtable-blocks-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a563df0782e092825d76e13be3d7f6df53a01cb0afe716bdc6a1bbe63692f9d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3815 Malicious code in airtable-blocks-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a563df0782e092825d76e13be3d7f6df53a01cb0afe716bdc6a1bbe63692f9d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in airtable-blocks-internal

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...