@biztory/n8n-nodes-tableau-rest-api (>=0.1.13, <=0.1.14), @easynet/n8n-local (0.0.37) +24 more potentially affected by CVE-2026-106119 via @langchain/mongodb (>=1.0.1, <=1.1.0)

@langchain/mongodb NPM version =1.0.1, =0.1.13, =2.35.2, =2.32.7, =2.32.0, =0.0.16, =1.4.13, =2.34.0, =0.1.4, =23.1.4, =1.0.0, =3.1.4 and more Source cves: CVE-2026-106119 Source advisory: GHSA-M6RX-H84Q-8R95...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts, which uses a regex-based blocklist to sanitize LLM-generated Python code before...

NPM: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

NPM: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

Protection Mechanism Failure

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Protection Mechanism Failure via the vm2/@flowiseai/nodevm JavaScript sandbox in the /api/v1/node-custom-function endpoint. An authenticated attacker can supply attacker-controlled...

NPM: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

authenticated RCE and arbitrary file read via Chromium vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

@biztory/n8n-nodes-tableau-rest-api (>=0.1.13, <=0.1.14), @easynet/n8n-local (0.0.37) +24 more potentially affected by CVE-2026-105799 via @langchain/redis (>=1.0.1, <=1.1.0)

@langchain/redis NPM version =1.0.1, =0.1.13, =2.35.2, =2.32.7, =2.32.0, =0.0.16, =1.4.13, =2.34.0, =0.1.4, =23.1.4, =1.0.0, =3.1.4 and more Source cves: CVE-2026-105799 Source advisory: OSV:GHSA-5X6V-P487-7QH2...

@biztory/n8n-nodes-tableau-rest-api (>=0.1.13, <=0.1.14), @easynet/n8n-local (0.0.37) +24 more potentially affected by CVE-2026-105799 via @langchain/redis (>=1.0.1, <=1.1.0)

@langchain/redis NPM version =1.0.1, =0.1.13, =2.35.2, =2.32.7, =2.32.0, =0.0.16, =1.4.13, =2.34.0, =0.1.4, =23.1.4, =1.0.0, =3.1.4 and more Source cves: CVE-2026-105799 Source advisory: GHSA-5X6V-P487-7QH2...

@cairncms/api (>=1.0.0-beta.1, <=1.0.0-beta.4), @dataform/cli (>=3.0.46, <=3.0.71) +26 more potentially affected by CVE-2026-92956 via vm2 (>=3.10.1, <=3.11.6)

vm2 NPM version =3.10.1, =1.0.0-beta.1, =3.0.46, =2.32.7, =2.32.0, =0.0.16, =1.4.13, =1.0.0, =1.1.15, =1.27.8, =1.0.0-beta.1, =1.0.0, =3.1.3, =3.1.4 - knowhy 0.1.2 and more Source cves: CVE-2026-92956 Source advisory: GHSA-WJWH-QQVP-G4P4...

@cairncms/api (>=1.0.0-beta.1, <=1.0.0-beta.4), @dataform/cli (>=3.0.46, <=3.0.71) +26 more potentially affected by CVE-2026-92944 via vm2 (>=3.10.2, <=3.11.6)

vm2 NPM version =3.10.2, =1.0.0-beta.1, =3.0.46, =2.32.7, =2.32.0, =0.0.16, =1.4.13, =1.0.0, =1.1.15, =1.27.8, =1.0.0-beta.1, =1.0.0, =3.1.3, =3.1.4 - knowhy 0.1.2 and more Source cves: CVE-2026-92944 Source advisory: GHSA-27G9-P43V-CW3V...

CVE-2026-100609

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100609

The Flowise npm packages (flowise and flowise-components) versions through 3.1.4 are vulnerable to an Insecure Direct Object Reference (IDOR) . The software fails to filter credential lookups by the requesting user's workspaceId when querying by ID. This flaw affects several code paths, including...

EUVD-2026-87704

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100609 Flowise through 3.1.4 Insecure Direct Object Reference via Credential

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100609: Authorization Bypass Through User-Controlled Key

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

copilot-studio-datainsight (>=0.0.1, <=0.0.6), flowise (>=1.6.1, <=2.2.8) potentially affected by CVE-2026-91938 via flowise-components (>=1.3.4, <=2.2.8)

flowise-components NPM version =1.3.4, =0.0.1, =1.6.1, =2.2.8 Source cves: CVE-2026-91938 Source advisory: MEND:CVE-2026-91938...

copilot-studio-datainsight (>=0.0.1, <=0.0.6), flowise (>=1.6.1, <=2.2.8) potentially affected by CVE-2026-91935 via flowise-components (>=1.3.4, <=2.2.8)

flowise-components NPM version =1.3.4, =0.0.1, =1.6.1, =2.2.8 Source cves: CVE-2026-91935 Source advisory: MEND:CVE-2026-91935...

copilot-studio-datainsight (>=0.0.1, <=0.0.6), flowise (>=1.6.1, <=2.2.8) potentially affected by CVE-2026-91934 via flowise-components (>=1.3.4, <=2.2.8)

flowise-components NPM version =1.3.4, =0.0.1, =1.6.1, =2.2.8 Source cves: CVE-2026-91934 Source advisory: MEND:CVE-2026-91934...

flowise (>=2.0.0, <=2.2.8) potentially affected by CVE-2026-91932 via flowise-components (2.2.8)

flowise-components NPM version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on flowise-components and may be impacted: - flowise =2.0.0, =2.2.8 Source cves: CVE-2026-91932 Source advisory: MEND:CVE-2026-91932...

copilot-studio-datainsight (>=0.0.1, <=0.0.6), flowise (>=1.6.1, <=2.2.8) potentially affected by CVE-2026-73601 via flowise-components (>=1.3.4, <=2.2.8)

flowise-components NPM version =1.3.4, =0.0.1, =1.6.1, =2.2.8 Source cves: CVE-2026-73601 Source advisory: MEND:CVE-2026-73601...

copilot-studio-datainsight (>=0.0.1, <=0.0.6), flowise (>=1.6.1, <=2.2.8) potentially affected by CVE-2026-73486 via flowise-components (>=1.3.4, <=2.2.8)

flowise-components NPM version =1.3.4, =0.0.1, =1.6.1, =2.2.8 Source cves: CVE-2026-73486 Source advisory: MEND:CVE-2026-73486...