This repository was archived by the owner on Aug 13, 2026. It is now read-only.
Security: FlowiseAI/Flowise
Security Advisories
View information about security vulnerabilities from this repository's maintainers.
-
Cross-workspace credential IDOR in node-load-method allows low-privilege users to enumerate victim third-party resourcesGHSA-hqvm-7539-v83j published
Aug 28, 2026 by igor-magun-wdModerate -
Rce viaCSVAgent csvFile data URI base64 segment is interpolated into Python source without validation,GHSA-4j8x-x6v7-w9rq published
Jul 29, 2026 by igor-magun-wdCritical -
Flowise RCE via SQLite Record Manager NodeGHSA-x3hf-7cj6-3r4m published
Jul 29, 2026 by igor-magun-wdCritical -
CSV Agent Prompt Injection Remote Code Execution VulnerabilityGHSA-5xvg-pmgg-3mxr published
Jul 29, 2026 by igor-magun-wdCritical -
Airtable_Agent Code Injection Remote Code Execution VulnerabilityGHSA-c5hr-rc98-xp3g published
Jul 29, 2026 by igor-magun-wdCritical -
CSV_Agent customReadCSV Code Injection Remote Code Execution VulnerabilityGHSA-4878-cqgq-j53v published
Jul 29, 2026 by igor-magun-wdCritical -
`DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow typeGHSA-p5w8-m249-4r4v published
Jul 29, 2026 by igor-magun-wdHigh -
Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organizationGHSA-wp74-f5hh-5f3r published
Jul 29, 2026 by igor-magun-wdHigh -
Authenticated arbitrary file write in Flowise `S3 Directory` document loader via unsanitized S3 object keysGHSA-88pr-878c-24wf published
Jul 29, 2026 by igor-magun-wdHigh -
Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass in FlowiseGHSA-w7x8-q2gp-5cgg published
Jul 29, 2026 by igor-magun-wdCritical