CVE-2026-69264

Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...

Malicious code in robust-free-bootstrap-admin-template (npm)

The package robust-free-bootstrap-admin-template was found to contain malicious code...