Zaloguj się
Deutsch English Español Polski
Krytyczna

Flowise OS command remote code execution

  • Ujawniono: 14.08.2025
  • Aktualizacja: 11.10.2026 10:22

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Paczka npm flowise <= 3.0.5 brak poprawki

Odnośniki

Ocena CVSS 9.8/10
Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Słabość (CWE)
CWE-306, CWE-78
Platforma
npm
Paczka
flowise
Ujawniono
14.08.2025
Aktualizacja
11.10.2026 10:22

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-2vv2-3x8x-4gv7 - CC BY 4.0

Historia podatności: flowise

Wszystkie opisane podatności tej paczki (Paczka npm), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (114) w archiwum
Wszystkich wpisów
114
Pierwsza → ostatnia
04.2024 10.2026
Bez poprawki
16
Wykorzystywana w atakach
0

Rozkład istotności

  • Krytyczna 28
  • Wysoka 62
  • Średnia 24

Ujawnienia w latach

Istotność:
  1. Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
    Krytyczna CVE-2026-73487 < 3.1.3 3.1.3
  2. Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
    Krytyczna CVE-2026-73483 < 3.1.3 3.1.3
  3. Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
    Krytyczna CVE-2026-70478 < 3.1.3 3.1.3
  4. Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
    Krytyczna CVE-2026-70477 < 3.1.3 3.1.3
  5. Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
    Wysoka CVE-2026-70476 < 3.1.3 3.1.3
  6. Flowise: Missing Authorization on Execution Update Endpoint
    Wysoka CVE-2026-70475 < 3.1.3 3.1.3
  7. Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
    Wysoka CVE-2026-70474 < 3.1.3 3.1.3
  8. Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
    Wysoka CVE-2026-70473 < 3.1.3 3.1.3
  9. Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store
    Wysoka CVE-2026-70472 < 3.1.3 3.1.3
  10. Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
    Krytyczna CVE-2026-69264 < 3.1.3 3.1.3
  11. Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys
    Wysoka ghsa-88pr-878c-24wf < 3.1.3 3.1.3
  12. Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
    Wysoka CVE-2026-70471 < 3.1.3 3.1.3
  13. Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
    Krytyczna CVE-2026-70470 < 3.1.3 3.1.3
  14. Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
    Wysoka CVE-2026-69263 < 3.1.3 3.1.3
  15. Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type
    Wysoka CVE-2026-69262 < 3.1.3 3.1.3
  16. Flowise RCE via SQLite Record Manager Node
    Krytyczna CVE-2026-69259 < 3.1.3 3.1.3
  17. Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API
    Wysoka CVE-2026-69258 < 3.1.3 3.1.3
  18. Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses
    Wysoka CVE-2026-69257 < 3.1.3 3.1.3
  19. Flowise: Remote Code Execution Vulnerability in CSVAgent
    Krytyczna CVE-2026-69256 < 3.1.3 3.1.3
  20. Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
    Krytyczna CVE-2026-69255 < 3.1.3 3.1.3
  21. Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
    Krytyczna CVE-2026-69254 < 3.1.3 3.1.3
  22. Flowise Sandbox Escape to RCE
    Krytyczna CVE-2026-69253 < 3.1.3 3.1.3
  23. Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization
    Wysoka CVE-2026-69252 < 3.1.3 3.1.3
  24. Flowise RCE via TypeORM DataSource
    Krytyczna CVE-2026-69251 < 3.1.3 3.1.3
  25. Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration
    Wysoka CVE-2026-69250 < 3.1.3 3.1.3
  26. FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover
    Wysoka · 8.8 CVE-2026-46480 < 3.1.2 3.1.2
  27. FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover
    Wysoka · 8.8 CVE-2026-46479 < 3.1.2 3.1.2
  28. FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover
    Wysoka · 8.8 CVE-2026-46478 < 3.1.2 3.1.2
  29. FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover
    Wysoka · 8.8 CVE-2026-46477 < 3.1.2 3.1.2
  30. FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover
    Wysoka CVE-2026-46476 < 3.1.2 3.1.2
  31. FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover
    Wysoka · 8.8 CVE-2026-46475 < 3.1.2 3.1.2
  32. FlowiseAI: Vector Store No Permission Checks
    Wysoka · 8.8 CVE-2026-46444 < 3.1.2 3.1.2
  33. FlowiseAI Vulnerable to Credential Data Leak
    Wysoka CVE-2026-46443 < 3.1.2 3.1.2
  34. FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
    Krytyczna CVE-2026-46442 < 3.1.2 3.1.2
  35. FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment
    Wysoka CVE-2026-46441 < 3.1.2 3.1.2
  36. Flowise has an MCP Security Bypass that Enables RCE
    Wysoka CVE-2026-56274 < 3.1.2 3.1.2
  37. FlowiseAI Exposes Basic Auth Credentials via API
    Wysoka · 7.5 CVE-2026-46440 < 3.1.2 3.1.2
  38. FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment
    Wysoka CVE-2026-42863 < 3.1.2 3.1.2
  39. FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment
    Wysoka CVE-2026-42862 < 3.1.2 3.1.2
  40. FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment
    Wysoka CVE-2026-42861 < 3.1.2 3.1.2
  41. Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
    Krytyczna · 9.8 CVE-2026-41264 < 3.1.0 3.1.0
  42. Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
    Krytyczna · 9.8 CVE-2026-41265 < 3.1.0 3.1.0
  43. Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials
    Wysoka · 7.5 CVE-2026-41279 < 3.1.0 3.1.0
  44. Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs
    Wysoka · 7.5 CVE-2026-41278 < 3.1.0 3.1.0
  45. Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)
    Wysoka · 8.8 CVE-2026-41277 < 3.1.0 3.1.0
  46. Flowise: resetPassword Authentication Bypass Vulnerability
    Wysoka · 9.8 CVE-2026-41276 < 3.1.0 3.1.0
  47. Flowise: Cypher Injection in GraphCypherQAChain
    Wysoka CVE-2026-41274 < 3.1.0 3.1.0
  48. Flowise: Password Reset Link Sent Over Unsecured HTTP
    Wysoka · 7.5 CVE-2026-41275 < 3.1.0 3.1.0
  49. Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow in Flowise
    Wysoka · 8.2 CVE-2026-41273 < 3.1.0 3.1.0
  50. Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
    Wysoka · 7.1 CVE-2026-41271 < 3.1.0 3.1.0
  51. Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
    Wysoka · 7.1 CVE-2026-41272 < 3.1.0 3.1.0
  52. Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox
    Wysoka · 7.1 CVE-2026-41270 < 3.1.0 3.1.0
  53. Flowise: File Upload Validation Bypass in createAttachment
    Wysoka · 7.1 CVE-2026-41269 < 3.1.0 3.1.0
  54. Flowise: Parameter Override Bypass Remote Command Execution
    Wysoka · 7.7 CVE-2026-41268 < 3.1.0 3.1.0
  55. Flowise: Sensitive Data Leak in public-chatbotConfig
    Wysoka · 7.5 CVE-2026-41266 < 3.1.0 3.1.0
  56. Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association
    Wysoka · 8.1 CVE-2026-41267 < 3.1.0 3.1.0
  57. Flowise: Code Injection in CSVAgent leads to Authenticated RCE
    Krytyczna · 8.8 CVE-2026-41137 < 3.1.0 3.1.0
  58. Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.
    Wysoka · 8.3 CVE-2026-41138 < 3.1.0 3.1.0
  59. Flowise: Authenticated RCE Via MCP Adapters
    Krytyczna · 9.9 CVE-2026-40933 < 3.1.0 3.1.0
  60. Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access
    Wysoka · 7.1 CVE-2026-31829 < 3.0.13 3.0.13
  61. Flowise Missing Authentication on NVIDIA NIM Endpoints
    Wysoka CVE-2026-30824 < 3.0.13 3.0.13
  62. Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration
    Wysoka · 8.8 CVE-2026-30823 < 3.0.13 3.0.13
  63. Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint
    Wysoka · 7.7 CVE-2026-30822 < 3.0.13 3.0.13
  64. Flowise has Arbitrary File Upload via MIME Spoofing
    Wysoka CVE-2026-30821 < 3.0.13 3.0.13
  65. Flowise has Authorization Bypass via Spoofed x-request-from Header
    Wysoka CVE-2026-30820 < 3.0.13 3.0.13
  66. Flowise has Authentication Bypass Using Unprotected Registration Endpoint (/register)
    Wysoka CVE-2025-71327 = 3.0.1 brak poprawki
  67. Flowise Fails to Invalidate Existing Sessions After Password Changes
    Wysoka · 8.1 CVE-2025-71335 < 3.0.10 3.0.10
  68. Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages
    Wysoka CVE-2025-34267 >= 3.0.1, < 3.0.8 3.0.8
  69. Flowise is vulnerable to arbitrary file exposure through its ReadFileTool
    Wysoka · 7.7 ghsa-j44m-5v8f-gc9c < 3.0.8 3.0.8
  70. Flowise is vulnerable to arbitrary file write through its WriteFileTool
    Krytyczna · 9.9 CVE-2025-61913 < 3.0.8, < 3.0.8 3.0.8
  71. FlowiseAI/Flosise has File Upload vulnerability
    Wysoka · 8.3 CVE-2025-61687 >= 3.0.7, < 3.0.8 3.0.8
  72. Flowise vulnerable to RCE via Dynamic function constructor injection
    Krytyczna · 9.8 CVE-2025-55346 <= 2.2.7-patch.1 brak poprawki
  73. Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel
    Krytyczna · 9.3 CVE-2025-50538 < 3.0.8 3.0.8
  74. Flowise has unsandboxed remote code execution via Custom MCP
    Wysoka CVE-2025-71336 >= 2.2.7-patch.1, < 3.0.6 3.0.6
  75. Flowise has arbitrary file access due to missing chat flow id validation
    Krytyczna · 9.8 CVE-2025-71334 >= 2.2.8, < 3.0.6 3.0.6
  76. Flowise has an Arbitrary File Read
    Krytyczna · 9.1 CVE-2025-71324 >= 3.0.5, < 3.0.6 3.0.6
  77. Flowise has Remote Code Execution vulnerability
    Krytyczna · 10.0 CVE-2025-59528 >= 3.0.5, < 3.0.6 3.0.6
  78. FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability
    Wysoka · 7.5 CVE-2025-59527 >= 3.0.5, < 3.0.6 3.0.6
  79. FlowiseAI Pre-Auth Arbitrary Code Execution
    Krytyczna · 9.1 CVE-2025-57164 >= 3.0.5, < 3.0.6 3.0.6
  80. Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover
    Krytyczna · 9.8 CVE-2025-58434 < 3.0.6 3.0.6
  81. Flowise OS command remote code execution ten wpis
    Krytyczna · 9.8 CVE-2025-8943 <= 3.0.5 brak poprawki
  82. Flowise allows arbitrary file write to RCE
    Krytyczna · 10.0 CVE-2025-71338 <= 2.2.7 brak poprawki
  83. Flowise Pre-auth Arbitrary File Upload
    Krytyczna CVE-2025-71333 <= 2.2.7 brak poprawki
  84. FlowiseAI Flowise arbitrary file upload vulnerability
    Wysoka CVE-2025-26319 <= 2.2.6 brak poprawki
  85. Flowise OverrideConfig security vulnerability
    Wysoka CVE-2024-58351 < 2.1.4 2.1.4
  86. Flowise Unauthenticated Denial of Service (DoS) vulnerability
    Wysoka · 7.5 CVE-2024-8182 <= 1.8.2 brak poprawki
  87. Flowise Authentication Bypass vulnerability
    Wysoka · 7.3 CVE-2024-8181 <= 1.8.2 brak poprawki
  88. Flowise Cors Misconfiguration in packages/server/src/index.ts
    Wysoka · 7.5 CVE-2024-36421 <= 1.4.3 brak poprawki
  89. Flowise Path Injection at /api/v1/openai-assistants-file
    Wysoka · 7.5 CVE-2024-36420 <= 1.4.3 brak poprawki
  90. Flowise vulnerable to code injection via api/v1
    Wysoka · 7.6 CVE-2024-31621 < 1.8.1 1.8.1

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.