475757 matches found
EUVD-2026-52739
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that code, they inserted a user-controlled...
CVE-2026-69253 Flowise Sandbox Escape to RCE
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that code, they inserted a user-controlled...
CVE-2026-69253
Summary of findings (CVE-2026-69253). Flowise allowed in-process vm2 sandbox JavaScript execution for several tools (AgentAsTool, ChatflowTool, ExecuteFlow) with the baseURL injected into generated code, enabling code injection and sandbox escape. The vulnerability arises because baseURL validati...
GHSA-WG86-R78F-74MP Flowise Sandbox Escape to RCE
============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: Luke Jahnke and Alex Brown Affects: FlowiseAI/Flowise 3.1.1, FlowiseAI/nodevm...
EUVD-2026-52726
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...
CVE-2026-69252
Flowise CVE-2026-69252: Before 3.1.3, the /api/v1/files route was protected only by feat:files and did not enforce checkPermission on GET/DELETE. A low-privileged, authenticated API key could list files under the organization root and delete files in other workspaces within the same organization ...
CVE-2026-69252 Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...
CLSA-2026-1785815205 TuxCare security update for org.springframework (24 CVEs)
TuxCare rebuilt 22 org.springframework packages to address 24 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.2...
CLSA-2026-1785468082 TuxCare security update for lodash-es (6 CVEs)
TuxCare rebuilt lodash-es to address 6 CVEs. Fixed in 4.17.15-tuxcare.1...
CLSA-2026-1785380881 TuxCare security update for ws (2 CVEs)
TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.16.0-tuxcare.2...
CLSA-2026-1785554485 TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.6-tuxcare.6...
CLSA-2026-1785380788 TuxCare security update for protobufjs (11 CVEs)
TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 1.5.1-tuxcare.1...
CLSA-2026-1785380760 TuxCare security update for axios (7 CVEs)
TuxCare rebuilt axios to address 7 CVEs. Fixed in 1.7.9-tuxcare.3...
CLSA-2026-1785204347 TuxCare security update for karma (3 CVEs)
TuxCare rebuilt karma to address 3 CVEs. Fixed in 1.5.0-tuxcare.1...
CLSA-2026-1785204577 TuxCare security update for 6 packages (1 CVE)
TuxCare rebuilt 6 packages to address 1 CVE. Fixed in 19.2.0-tuxcare.6...
CLSA-2026-1785204344 TuxCare security update for xmlhttprequest-ssl (11 CVEs)
TuxCare rebuilt xmlhttprequest-ssl to address 11 CVEs. Fixed in 1.5.1-tuxcare.1...
CLSA-2026-1785380784 TuxCare security update for org.apache.logging.log4j (1 CVE)
TuxCare rebuilt 32 org.apache.logging.log4j packages to address 1 CVE. Fixed in 2.22.1-tuxcare.3...
CLSA-2026-1785292011 TuxCare security update for org.springframework (2 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 2 CVEs. Fixed in 6.1.20-tuxcare.7...