acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

Flowise < 3.1.2 - node-custom-function Unauthorized RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

CVE-2026-76364

In Splunk SOAR versions below 8.6.0, a user holding the "Automation Engineer" role can inject arbitrary SQL via custom function results, because Splunk SOAR builds the database lookup using a supplied name instead of a bound SQL value, enabling full database read access and integrity compromise. ...

PT-2026-71423

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description A sandbox escape exists in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the '/api/v1/node-custom-function' endpoint can escape the sandbox by providing...

CVE-2026-19359 nxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control

A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version...

CVE-2026-19359

The CVE affects nxp-auto-goldvip gvip up to 1.4.0, specifically the SitewiseCustomFunction in the Lambda Function Handler. The issue enables improper access controls and can be exploited remotely. A fix is available in version 1.15.0; upgrading the affected component is advised. The accompanying ...

EUVD-2026-54930

A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version...

CVE-2026-19359 nxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control

A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version...

CVE-2026-70471

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetche...

CVE-2026-67214

nanoid Nano ID before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module nanoid/non-secure. When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination conditio...

VulnCheck KEV: CVE-2026-46442

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in Databasedefinefunction and Databasecreatefunction through the custom function registry in lib/sqlite3/database.rb. An attacker can trigger a segmentation fault by redefining the same SQLite function name with a differe...

CVE-2026-46442

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

CVE-2026-46442

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

EUVD-2026-35110

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

CVE-2026-46442

Flowise prior to v3.1.2 exposes an unauthenticated route POST /api/v1/node-custom-function that can accept arbitrary JavaScript in a Custom JS Function node. If E2B_APIKEY is not configured, code runs in a NodeVM sandbox and can be escaped to reach host process and execute system commands, enabli...

CVE-2026-46442 Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

CVE-2026-46442 Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

Flowise 代码注入漏洞

Flowise is an open-source tool developed by FlowiseAI, designed for easily building LLM applications. Versions of Flowise prior to 3.1.2 contained a code injection vulnerability. This vulnerability stemmed from the lack of routing-level authorization in the POST /api/v1/node-custom-function...

CVE-2026-46442: Improper Control of Generation of Code

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...