HIGH npm
GHSA-28g4-38q8-3cwc · CVE-2026-41274 Flowise: Cypher Injection in GraphCypherQAChain
Modified: 5/5/2026
package
npm / flowise-components
pkg:npm/flowise-components
HIGH 7.1 npm
GHSA-2x8m-83vc-6wv4 · CVE-2026-41272 Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
Modified: 5/5/2026
CRITICAL 9.8 npm
GHSA-3hjv-c53m-58jj · CVE-2026-41264 Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
Modified: 5/5/2026
HIGH 7.1 npm
GHSA-6r77-hqx7-7vw8 · CVE-2026-41271 Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
Modified: 5/5/2026
MEDIUM npm
GHSA-9hrv-gvrv-6gf2 Flowise Execute Flow function has an SSRF vulnerability
Modified: 4/16/2026
HIGH 8.8 npm
GHSA-9wc7-mj3f-74xv · CVE-2026-41137 Flowise: Code Injection in CSVAgent leads to Authenticated RCE
Modified: 5/5/2026
CRITICAL 9.9 npm
GHSA-c9gw-hvqq-f33r · CVE-2026-40933 Flowise: Authenticated RCE Via MCP Adapters
Modified: 4/16/2026
HIGH 7.7 npm
GHSA-cvrr-qhgw-2mm6 · CVE-2026-41268 Flowise: Parameter Override Bypass Remote Command Execution
Modified: 5/5/2026
HIGH 8.3 npm
GHSA-f228-chmx-v6j6 · CVE-2026-41138 Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.
Modified: 5/5/2026
HIGH 7.1 npm
GHSA-fvcw-9w9r-pxc7 · CVE-2026-31829 Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access
Modified: 4/10/2026
HIGH 7.6 npm
GHSA-gjx9-wg9x-7gvp · CVE-2025-29189 Flowise Vulnerable to SQL Injection via `tableName` Parameter
Modified: 4/10/2025
HIGH 7.7 npm
GHSA-j44m-5v8f-gc9c Flowise is vulnerable to arbitrary file exposure through its ReadFileTool
Modified: 2/4/2026
CRITICAL 9.9 npm
GHSA-jv9m-vf54-chjj · CVE-2025-61913 Flowise is vulnerable to arbitrary file write through its WriteFileTool
Modified: 2/4/2026
HIGH npm
GHSA-m99r-2hxc-cp3q Flowise has an MCP Security Bypass that Enables RCE
Modified: 5/16/2026
MEDIUM npm
GHSA-qqvm-66q4-vf5c · CVE-2026-43995 Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)
Modified: 5/13/2026
CRITICAL 9.8 npm
GHSA-v38x-c887-992f · CVE-2026-41265 Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
Modified: 5/5/2026
MEDIUM npm
GHSA-w6v6-49gh-mc9w Flowise: Path Traversal in Vector Store basePath
Modified: 4/16/2026
HIGH 7.1 npm
GHSA-xhmj-rg95-44hv · CVE-2026-41270 Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox
Modified: 5/5/2026