CVE-2026-69256

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.readpickle could deserialize a pickled...

NPM: Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API

NPM: Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated overrideConfig Spread in Prediction API vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

CVE-2026-69258

Flowise before 3.1.3 is vulnerable: unauthenticated POST /api/v1/prediction/:id accepts an overrideConfig object that is blindly spread into internal flowConfig and flowData without validating apiOverrideStatus. This enables attackers to inject arbitrary properties into the flow execution context...

CVE-2026-69258 Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in...

Flowise OverrideConfig security vulnerability

Impact Flowise allows developers to inject configuration into the Chainflow during execution through the overrideConfig option. This is supported in both the frontend web integration and the backend Prediction API. This has a range of fundamental issues that are a major security vulnerability...