CVE-2026-73485

Flowise before version 3.1.3 contains a code injection vulnerability in the Airtable Agent node that lets unauthenticated attackers bypass the pythonCodeValidator blocklist via obfuscation and inject malicious Python code. The injected code can run in an unsandboxed pyodide environment with full ...

EUVD-2026-57800

Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like tocsv, tojson, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesyste...

CVE-2026-73484 Flowise before 3.1.3 Sandbox Escape via Pandas Methods

Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like tocsv, tojson, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesyste...

CVE-2026-73486: Improper Control of Generation of Code

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...

CVE-2026-73485: Improper Control of Generation of Code

Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the...

DEBIAN-CVE-2026-73233

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a...

UBUNTU-CVE-2026-73233

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a...

CVE-2026-73233

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a...

CVE-2026-73233

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a...

CVE-2026-73233

FreeCAD CVE-2026-73233 affects the FEM Displacement Constraint dialog prior to version 1.1.2. The escaping helper fails to neutralize backslashes, letting crafted x/y/zDisplacementFormula text terminate the generated Python string and execute arbitrary Python code with the FreeCAD process privile...

CVE-2026-73233 FreeCAD: FEM formula incomplete escape

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a...

PT-2026-70894

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a...

Flowise CSV_Agent customReadCSV Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Authentication is required to exploit this vulnerability. The specific flaw exists within the run method of the CSVAgents class. The issue results from the lack of proper validation of a...

CVE-2026-73233: Improper Control of Generation of Code

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a...

IBM Langflow OSS Code Execution Vulnerability

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a code execution vulnerability. This vulnerability stems from the use of truncated SHA-256 hashes for code verification by the custom component validation mechanism. The hashi...

CVE-2026-9196

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user...

CVE-2026-9196

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user...

CVE-2026-55522 PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow.executeinclude implicitly imports and runs an included recipe's tools.py via a raw...

CVE-2026-17632 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning...

CVE-2026-17632

CVE-2026-17632 affects IBM Langflow OSS versions 1.0.0–1.10.3. The vulnerability arises from improper validation of Python code during AST-based security scanning, enabling a remote authenticated attacker to execute arbitrary code. The NVD/CVE listings report a high-severity vector with CVSS 3.1:...