@biztory/n8n-nodes-tableau-rest-api (>=0.1.13, <=0.1.14), @easynet/n8n-local (0.0.37) +19 more potentially affected by CVE-2026-106119 via @langchain/mongodb (>=1.0.1, <=1.1.0)

@langchain/mongodb NPM version =1.0.1, =0.1.13, =2.35.2, =2.32.7, =2.32.0, =2.34.0, =0.1.4, =23.1.4, =3.1.0, =2.32.0, =0.0.1, =0.0.10 and more Source cves: CVE-2026-106119 Source advisory: GHSA-M6RX-H84Q-8R95...

NPM: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

NPM: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

authenticated RCE and arbitrary file read via Chromium vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

@biztory/n8n-nodes-tableau-rest-api (>=0.1.13, <=0.1.14), @easynet/n8n-local (0.0.37) +19 more potentially affected by CVE-2026-105799 via @langchain/redis (>=1.0.1, <=1.1.0)

@langchain/redis NPM version =1.0.1, =0.1.13, =2.35.2, =2.32.7, =2.32.0, =2.34.0, =0.1.4, =23.1.4, =3.1.0, =2.32.0, =0.0.1, =0.0.10 and more Source cves: CVE-2026-105799 Source advisory: OSV:GHSA-5X6V-P487-7QH2...

@biztory/n8n-nodes-tableau-rest-api (>=0.1.13, <=0.1.14), @easynet/n8n-local (0.0.37) +19 more potentially affected by CVE-2026-105799 via @langchain/redis (>=1.0.1, <=1.1.0)

@langchain/redis NPM version =1.0.1, =0.1.13, =2.35.2, =2.32.7, =2.32.0, =2.34.0, =0.1.4, =23.1.4, =3.1.0, =2.32.0, =0.0.1, =0.0.10 and more Source cves: CVE-2026-105799 Source advisory: GHSA-5X6V-P487-7QH2...

@cairncms/api (>=1.0.0-beta.1, <=1.0.0-beta.4), @dataform/cli (>=3.0.46, <=3.0.71) +21 more potentially affected by CVE-2026-92956 via vm2 (>=3.10.1, <=3.11.6)

vm2 NPM version =3.10.1, =1.0.0-beta.1, =3.0.46, =2.32.7, =2.32.0, =1.0.0, =1.1.15, =1.27.8, =1.0.0-beta.1, =2.32.0, =2.32.0, =1.68.2, =1.68.2, =1.74.9 and more Source cves: CVE-2026-92956 Source advisory: GHSA-WJWH-QQVP-G4P4...

@cairncms/api (>=1.0.0-beta.1, <=1.0.0-beta.4), @dataform/cli (>=3.0.46, <=3.0.71) +21 more potentially affected by CVE-2026-92944 via vm2 (>=3.10.2, <=3.11.6)

vm2 NPM version =3.10.2, =1.0.0-beta.1, =3.0.46, =2.32.7, =2.32.0, =1.0.0, =1.1.15, =1.27.8, =1.0.0-beta.1, =2.32.0, =2.32.0, =1.68.9, =1.68.9, =1.74.9 and more Source cves: CVE-2026-92944 Source advisory: GHSA-27G9-P43V-CW3V...

CVE-2026-100609

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100609 Flowise through 3.1.4 Insecure Direct Object Reference via Credential

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100609

The Flowise npm packages (flowise and flowise-components) versions through 3.1.4 are vulnerable to an Insecure Direct Object Reference (IDOR) . The software fails to filter credential lookups by the requesting user's workspaceId when querying by ID. This flaw affects several code paths, including...

EUVD-2026-87704

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100609: Authorization Bypass Through User-Controlled Key

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

copilot-studio-datainsight (>=0.0.1, <=0.0.6), flowise (>=1.6.1, <=1.8.4) potentially affected by CVE-2026-91938 via flowise-components (>=1.3.4, <=1.8.6)

flowise-components NPM version =1.3.4, =0.0.1, =1.6.1, =1.8.4 Source cves: CVE-2026-91938 Source advisory: MEND:CVE-2026-91938...

copilot-studio-datainsight (>=0.0.1, <=0.0.6), flowise (>=1.6.1, <=1.8.4) potentially affected by CVE-2026-91935 via flowise-components (>=1.3.4, <=1.8.6)

flowise-components NPM version =1.3.4, =0.0.1, =1.6.1, =1.8.4 Source cves: CVE-2026-91935 Source advisory: MEND:CVE-2026-91935...

copilot-studio-datainsight (>=0.0.1, <=0.0.6), flowise (>=1.6.1, <=1.8.4) potentially affected by CVE-2026-91934 via flowise-components (>=1.3.4, <=1.8.6)

flowise-components NPM version =1.3.4, =0.0.1, =1.6.1, =1.8.4 Source cves: CVE-2026-91934 Source advisory: MEND:CVE-2026-91934...

copilot-studio-datainsight (>=0.0.1, <=0.0.6), flowise (>=1.6.1, <=1.8.4) potentially affected by CVE-2026-73601 via flowise-components (>=1.3.4, <=1.8.6)

flowise-components NPM version =1.3.4, =0.0.1, =1.6.1, =1.8.4 Source cves: CVE-2026-73601 Source advisory: MEND:CVE-2026-73601...

copilot-studio-datainsight (>=0.0.1, <=0.0.6), flowise (>=1.6.1, <=1.8.4) potentially affected by CVE-2026-73486 via flowise-components (>=1.3.4, <=1.8.6)

flowise-components NPM version =1.3.4, =0.0.1, =1.6.1, =1.8.4 Source cves: CVE-2026-73486 Source advisory: MEND:CVE-2026-73486...

copilot-studio-datainsight (>=0.0.1, <=0.0.6), flowise (>=1.6.1, <=1.8.4) potentially affected by CVE-2026-73485 via flowise-components (>=1.3.4, <=1.8.6)

flowise-components NPM version =1.3.4, =0.0.1, =1.6.1, =1.8.4 Source cves: CVE-2026-73485 Source advisory: MEND:CVE-2026-73485...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via the run method in the CSVAgents class. An attacker can execute arbitrary code in the context of the server process by sending crafted prompts to a chatflow using...

copilot-studio-datainsight (>=0.0.1, <=0.0.6), flowise (>=1.6.1, <=1.8.4) potentially affected by CVE-2026-70477 via flowise-components (>=1.3.4, <=1.8.6)

flowise-components NPM version =1.3.4, =0.0.1, =1.6.1, =1.8.4 Source cves: CVE-2026-70477 Source advisory: MEND:CVE-2026-70477...