flowise-components
Page établie d’après les avis qui citent ce paquet : ses métadonnées de registre (versions, licence, dépendances) n’ont pas encore été récupérées par ce service.
En bref
- Écosystème
- npm
- État de vulnérabilité
- 31 avis sans verdict
Avis (31)
| Avis | Versions affectées | Dernière version |
|---|---|---|
| GHSA-28g4-38q8-3cwc Flowise: Cypher Injection in GraphCypherQAChain | < 3.1.0 | Indéterminé |
| GHSA-2x8m-83vc-6wv4 Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) | < 3.1.0 | Indéterminé |
| GHSA-3769-jgqc-cxm7 Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override | < 3.1.3 | Indéterminé |
| GHSA-3hjv-c53m-58jj Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability | < 3.1.0 | Indéterminé |
| GHSA-4j8x-x6v7-w9rq Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation | < 3.1.3 | Indéterminé |
| GHSA-52fh-8v99-63c2 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE | < 3.1.3 | Indéterminé |
| GHSA-5xvg-pmgg-3mxr Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability | < 3.1.3 | Indéterminé |
| GHSA-6r77-hqx7-7vw8 Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains | < 3.1.0 | Indéterminé |
| GHSA-88pr-878c-24wf Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys | < 3.1.3 | Indéterminé |
| GHSA-9gvv-qjj3-2p6g Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium | < 3.1.3 | Indéterminé |
| GHSA-9hrv-gvrv-6gf2 Flowise Execute Flow function has an SSRF vulnerability | < 3.1.0 | Indéterminé |
| GHSA-9wc7-mj3f-74xv Flowise: Code Injection in CSVAgent leads to Authenticated RCE | < 3.1.0 | Indéterminé |
| GHSA-c9gw-hvqq-f33r Flowise: Authenticated RCE Via MCP Adapters | < 3.1.0 | Indéterminé |
| GHSA-cvrr-qhgw-2mm6 Flowise: Parameter Override Bypass Remote Command Execution | < 3.1.0 | Indéterminé |
| GHSA-f228-chmx-v6j6 Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`. | < 3.1.0 | Indéterminé |
| GHSA-fvcw-9w9r-pxc7 Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access | < 3.0.13 | Indéterminé |
| GHSA-g32j-mmxr-gfq5 Flowise RCE via TypeORM DataSource | < 3.1.3 | Indéterminé |
| GHSA-gjx9-wg9x-7gvp Flowise Vulnerable to SQL Injection via `tableName` Parameter | < 2.2.4 | Indéterminé |
| GHSA-j44m-5v8f-gc9c Flowise is vulnerable to arbitrary file exposure through its ReadFileTool | < 3.0.8 | Indéterminé |
| GHSA-jv9m-vf54-chjj Flowise is vulnerable to arbitrary file write through its WriteFileTool | < 3.0.8 | Indéterminé |
| GHSA-m99r-2hxc-cp3q Flowise has an MCP Security Bypass that Enables RCE | < 3.1.2 | Indéterminé |
| GHSA-qqvm-66q4-vf5c Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) | < 3.1.0 | Indéterminé |
| GHSA-v38x-c887-992f Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability | < 3.1.0 | Indéterminé |
| GHSA-vmv7-4m6c-3cg5 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified | < 3.1.3 | Indéterminé |
| GHSA-w6v6-49gh-mc9w Flowise: Path Traversal in Vector Store basePath | < 3.1.0 | Indéterminé |
| GHSA-w7x8-q2gp-5cgg Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass | < 3.1.3 | Indéterminé |
| GHSA-wg86-r78f-74mp Flowise Sandbox Escape to RCE | < 3.1.3 | Indéterminé |
| GHSA-x3hf-7cj6-3r4m Flowise RCE via SQLite Record Manager Node | < 3.1.3 | Indéterminé |
| GHSA-x6vm-w76m-8j7g Flowise: Remote Code Execution Vulnerability in CSVAgent | < 3.1.3 | Indéterminé |
| GHSA-xc48-889x-5qmw Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) | < 3.1.3 | Indéterminé |
| GHSA-xhmj-rg95-44hv Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox | < 3.1.0 | Indéterminé |
Avis retirés (1)
Retirés par leur éditeur : ils ne concernent aucune version et ne sont pas comptés ci-dessus.
- GHSA-6j9g-8fxc-25hq Duplicate Advisory: Flowise contains an unauthenticated sandbox escape · retiré le
Sources
| Source | Licence |
|---|