74662 matches found
GHSA-X6VM-W76M-8J7G Flowise: Remote Code Execution Vulnerability in CSVAgent
Summary The CSVAgent node was observed to allow users to write Python code which gets executed via pyodide. The original intent was to allow users to utilise the pandas library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, panda...
Arbitrary Code Injection
Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection via unsanitized string interpolation in the CSVAgent process. An attacker can execute arbitrary operating system commands, read sensitive files, steal credentials, and cause denial ...
Arbitrary Code Injection
Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via unsanitized string interpolation in the CSVAgent process. An attacker can execute arbitrary operating system commands, read sensitive files, steal credentials, an...
CVE-2026-69255 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...
CVE-2026-69255
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...
SUSE-SU-2026:23120-1 Security update for python-httplib2
This update for python-httplib2 fixes the following issue - CVE-2026-59939: Fixed a vulnerability where a malicious or compromised HTTP server could return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process...
SUSE-SU-2026:23142-1 Security update for python-httplib2
This update for python-httplib2 fixes the following issue - CVE-2026-59939: Fixed a vulnerability where a malicious or compromised HTTP server could return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process...
OPENSUSE-SU-2026:21526-1 Security update for python-httplib2
This update for python-httplib2 fixes the following issue - CVE-2026-59939: Fixed a vulnerability where a malicious or compromised HTTP server could return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process...
CVE-2026-67195
Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval with only...
CVE-2026-18770
A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the component Python Validation Handler. The manipulation leads to code injection. Remote exploitation of the attack is possible. This produc...
EUVD-2026-52740
kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...
CVE-2026-69098
kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...
CLSA-2026-1783904617 TuxCare security update for python-multipart (1 CVE)
TuxCare rebuilt python-multipart to address 1 CVE. Fixed in 0.0.6.post6+tuxcare...
CLSA-2026-1782781170 TuxCare security update for python-multipart (1 CVE)
TuxCare rebuilt python-multipart to address 1 CVE. Fixed in 0.0.6.post4+tuxcare...
CLSA-2026-1782954025 TuxCare security update for python-multipart (2 CVEs)
TuxCare rebuilt python-multipart to address 2 CVEs. Fixed in 0.0.6.post5+tuxcare...
CLSA-2026-1781571262 TuxCare security update for python-multipart (1 CVE)
TuxCare rebuilt python-multipart to address 1 CVE. Fixed in 0.0.6.post3+tuxcare...
CLSA-2026-1780274962 TuxCare security update for aiohttp (1 CVE)
TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.1.post9+tuxcare...
CLSA-2025-1765930332 TuxCare security update for mysql-connector-python (1 CVE)
TuxCare rebuilt mysql-connector-python to address 1 CVE. Fixed in 8.4.0.post1+tuxcare...