PT-2026-71426

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...

CVE-2026-73487: Improper Control of Generation of Code

Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.readjson to exfiltrate datasets, perform SSRF...

CVE-2026-73486: Improper Control of Generation of Code

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...

CVE-2026-19751: Server-Side Request Forgery (SSRF)

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

PT-2026-71427

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description A regex-based Python code validator bypass exists in the CSV and Airtable Agent nodes. This allows unauthenticated attackers to inject malicious code through prompt injection. By exploiting unblocked...

PT-2026-71874

Name of the Vulnerable Software and Affected Versions EnzoVezzaro mcp-dominican-layer versions up to 39dd373786712650097ad31db27d5c477c8f9c82 Description A flaw in the parse-csv tool component allows remote attackers to perform server-side request forgery SSRF, a technique where an attacker induc...

CVE-2026-48813

A flaw was found in Flawfinder. An improper input neutralization issue leads to output manipulation, specifically, terminal/ANSI escape sequence injection and XML injection. A malicious filename can inject arbitrary content in the terminal output and improperly sanitized fields such as filenames,...

CVE-2026-64955

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not...

CVE-2026-64955 Velociraptor CSV Formula Injection in Export Pipeline

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not...

CVE-2026-64955

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not...

EUVD-2026-57158

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not...

CVE-2026-64955 Velociraptor CSV Formula Injection in Export Pipeline

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not...

CVE-2026-64955

CVE-2026-64955 describes that when Microsoft Excel imports a CSV file, it may execute cells beginning with certain characters as formulas, enabling arbitrary execution. The advisory associates Velociraptor’s CSV export paths (GUI, offline collector, data exports) as the context, indicating Veloci...

CVE-2026-64955 Velociraptor CSV Formula Injection in Export Pipeline

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not...

CVE-2026-64955: Improper Neutralization of Formula Elements in a CSV File

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not...

PT-2026-71046

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not...

CVE-2026-48813

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

EUVD-2026-56901

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

CVE-2026-47705

TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into input fields, which are later execute...

CVE-2026-47705 TypeBot vulnerable to CSV injection in result export

TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into input fields, which are later execute...