CVE-2026-69253 Flowise Sandbox Escape to RCE

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that code, they inserted a user-controlled...

CVE-2026-69253

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that code, they inserted a user-controlled...

GHSA-WG86-R78F-74MP Flowise Sandbox Escape to RCE

============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: Luke Jahnke and Alex Brown Affects: FlowiseAI/Flowise 3.1.1, FlowiseAI/nodevm...

OPENSUSE-SU-2026:21529-1 Security update for perl-HTTP-Tiny

This update for perl-HTTP-Tiny fixes the following issues: Changes in perl-HTTP-Tiny: - updated to 0.096 - CVE-2026-7017: Fixed forwarded credential headers to cross-origin redirect targets bsc1271020 - Caller-supplied Authorization, Cookie, and Proxy-Authorization headers are now stripped on...

EUVD-2026-52726

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...

CVE-2026-69252 Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...

CVE-2026-69252 Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...

CVE-2026-69252

Flowise CVE-2026-69252: Before 3.1.3, the /api/v1/files route was protected only by feat:files and did not enforce checkPermission on GET/DELETE. A low-privileged, authenticated API key could list files under the organization root and delete files in other workspaces within the same organization ...

CLSA-2026-1785380881 TuxCare security update for ws (2 CVEs)

TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.16.0-tuxcare.2...

CLSA-2026-1785815308 TuxCare security update for certifi (1 CVE)

TuxCare rebuilt certifi to address 1 CVE. Fixed in 2021.10.8.post3+tuxcare...

CLSA-2026-1785380888 TuxCare security update for axios (1 CVE)

TuxCare rebuilt axios to address 1 CVE. Fixed in 0.18.1-tuxcare.4...

CLSA-2026-1785467924 TuxCare security update for axios (1 CVE)

TuxCare rebuilt axios to address 1 CVE. Fixed in 0.15.3-tuxcare.6...

CLSA-2026-1785815205 TuxCare security update for org.springframework (23 CVEs)

TuxCare rebuilt 18 org.springframework packages to address 23 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.2...

CLSA-2026-1785727930 TuxCare security update for org.assertj:assertj-core (1 CVE)

TuxCare rebuilt org.assertj:assertj-core to address 1 CVE. Fixed in 3.11.1-tuxcare.1...

CLSA-2026-1785468080 TuxCare security update for axios (15 CVEs)

TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.26.0-tuxcare.4...

CLSA-2026-1785554485 TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.6-tuxcare.6...

CLSA-2026-1785468081 TuxCare security update for lodash-es (3 CVEs)

TuxCare rebuilt lodash-es to address 3 CVEs. Fixed in 4.17.21-tuxcare.1...

CLSA-2026-1785468075 TuxCare security update for protobufjs (11 CVEs)

TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 6.8.8-tuxcare.1...

CLSA-2026-1785380885 TuxCare security update for storybook (2 CVEs)

TuxCare rebuilt storybook to address 2 CVEs. Fixed in 10.1.9-tuxcare.1...

CLSA-2026-1785727931 TuxCare security update for org.springframework.security:spring-security-saml2-service-provider (3 CVEs)

TuxCare rebuilt org.springframework.security:spring-security-saml2-service-provider to address 3 CVEs. Fixed in 5.7.12-tuxcare.6...