flowise-components
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- npm
- Vulnerability status
- 31 advisory(ies) without a verdict
Advisories (31)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-28g4-38q8-3cwc Flowise: Cypher Injection in GraphCypherQAChain | < 3.1.0 | Undetermined |
| GHSA-2x8m-83vc-6wv4 Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) | < 3.1.0 | Undetermined |
| GHSA-3769-jgqc-cxm7 Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override | < 3.1.3 | Undetermined |
| GHSA-3hjv-c53m-58jj Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability | < 3.1.0 | Undetermined |
| GHSA-4j8x-x6v7-w9rq Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation | < 3.1.3 | Undetermined |
| GHSA-52fh-8v99-63c2 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE | < 3.1.3 | Undetermined |
| GHSA-5xvg-pmgg-3mxr Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability | < 3.1.3 | Undetermined |
| GHSA-6r77-hqx7-7vw8 Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains | < 3.1.0 | Undetermined |
| GHSA-88pr-878c-24wf Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys | < 3.1.3 | Undetermined |
| GHSA-9gvv-qjj3-2p6g Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium | < 3.1.3 | Undetermined |
| GHSA-9hrv-gvrv-6gf2 Flowise Execute Flow function has an SSRF vulnerability | < 3.1.0 | Undetermined |
| GHSA-9wc7-mj3f-74xv Flowise: Code Injection in CSVAgent leads to Authenticated RCE | < 3.1.0 | Undetermined |
| GHSA-c9gw-hvqq-f33r Flowise: Authenticated RCE Via MCP Adapters | < 3.1.0 | Undetermined |
| GHSA-cvrr-qhgw-2mm6 Flowise: Parameter Override Bypass Remote Command Execution | < 3.1.0 | Undetermined |
| GHSA-f228-chmx-v6j6 Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`. | < 3.1.0 | Undetermined |
| GHSA-fvcw-9w9r-pxc7 Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access | < 3.0.13 | Undetermined |
| GHSA-g32j-mmxr-gfq5 Flowise RCE via TypeORM DataSource | < 3.1.3 | Undetermined |
| GHSA-gjx9-wg9x-7gvp Flowise Vulnerable to SQL Injection via `tableName` Parameter | < 2.2.4 | Undetermined |
| GHSA-j44m-5v8f-gc9c Flowise is vulnerable to arbitrary file exposure through its ReadFileTool | < 3.0.8 | Undetermined |
| GHSA-jv9m-vf54-chjj Flowise is vulnerable to arbitrary file write through its WriteFileTool | < 3.0.8 | Undetermined |
| GHSA-m99r-2hxc-cp3q Flowise has an MCP Security Bypass that Enables RCE | < 3.1.2 | Undetermined |
| GHSA-qqvm-66q4-vf5c Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) | < 3.1.0 | Undetermined |
| GHSA-v38x-c887-992f Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability | < 3.1.0 | Undetermined |
| GHSA-vmv7-4m6c-3cg5 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified | < 3.1.3 | Undetermined |
| GHSA-w6v6-49gh-mc9w Flowise: Path Traversal in Vector Store basePath | < 3.1.0 | Undetermined |
| GHSA-w7x8-q2gp-5cgg Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass | < 3.1.3 | Undetermined |
| GHSA-wg86-r78f-74mp Flowise Sandbox Escape to RCE | < 3.1.3 | Undetermined |
| GHSA-x3hf-7cj6-3r4m Flowise RCE via SQLite Record Manager Node | < 3.1.3 | Undetermined |
| GHSA-x6vm-w76m-8j7g Flowise: Remote Code Execution Vulnerability in CSVAgent | < 3.1.3 | Undetermined |
| GHSA-xc48-889x-5qmw Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) | < 3.1.3 | Undetermined |
| GHSA-xhmj-rg95-44hv Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox | < 3.1.0 | Undetermined |
Withdrawn advisories (1)
Withdrawn by their publisher: they affect no version and are not counted above.
- GHSA-6j9g-8fxc-25hq Duplicate Advisory: Flowise contains an unauthenticated sandbox escape · withdrawn
Sources
| Source | Licence |
|---|