flowise-components (npm)
Advisories
32
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.1.3 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install flowise-components@3.1.3yarn
yarn add flowise-components@3.1.3pnpm
pnpm add flowise-components@3.1.3Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-6j9g-8fxc-25hq Duplicate Advisory: Flowise contains an unauthenticated sandbox escape Withdrawn |
High | < 3.1.3 | 3.1.3 |
| GHSA-w7x8-q2gp-5cgg Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass |
Critical EPSS 0.96% |
< 3.1.3 | 3.1.3 |
| GHSA-9gvv-qjj3-2p6g Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium |
High EPSS 0.62% |
< 3.1.3 | 3.1.3 |
| GHSA-5xvg-pmgg-3mxr Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability |
Critical EPSS 0.81% |
< 3.1.3 | 3.1.3 |
| GHSA-4j8x-x6v7-w9rq Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation |
Critical EPSS 1.11% |
< 3.1.3 | 3.1.3 |
| GHSA-88pr-878c-24wf Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys |
High | < 3.1.3 | 3.1.3 |
| GHSA-52fh-8v99-63c2 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE |
Critical EPSS 0.97% |
< 3.1.3 | 3.1.3 |
| GHSA-xc48-889x-5qmw Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) |
Critical EPSS 0.66% |
< 3.1.3 | 3.1.3 |
| GHSA-x3hf-7cj6-3r4m Flowise RCE via SQLite Record Manager Node |
High EPSS 0.82% |
< 3.1.3 | 3.1.3 |
| GHSA-x6vm-w76m-8j7g Flowise: Remote Code Execution Vulnerability in CSVAgent |
High EPSS 1.01% |
< 3.1.3 | 3.1.3 |
| GHSA-vmv7-4m6c-3cg5 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified |
High EPSS 0.60% |
< 3.1.3 | 3.1.3 |
| GHSA-3769-jgqc-cxm7 Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override |
High EPSS 0.69% |
< 3.1.3 | 3.1.3 |
| GHSA-wg86-r78f-74mp Flowise Sandbox Escape to RCE |
High EPSS 0.66% |
< 3.1.3 | 3.1.3 |
| GHSA-g32j-mmxr-gfq5 Flowise RCE via TypeORM DataSource |
High EPSS 2.74% |
< 3.1.3 | 3.1.3 |
| GHSA-m99r-2hxc-cp3q Flowise has an MCP Security Bypass that Enables RCE |
Critical EPSS 7.52% |
< 3.1.2 | 3.1.2 |
| GHSA-3hjv-c53m-58jj Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability |
Critical EPSS 1.79% |
< 3.1.0 | 3.1.0 |
| GHSA-v38x-c887-992f Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability |
Critical EPSS 0.57% |
< 3.1.0 | 3.1.0 |
| GHSA-28g4-38q8-3cwc Flowise: Cypher Injection in GraphCypherQAChain |
Critical EPSS 0.51% |
< 3.1.0 | 3.1.0 |
| GHSA-6r77-hqx7-7vw8 Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains |
High EPSS 0.23% |
< 3.1.0 | 3.1.0 |
| GHSA-2x8m-83vc-6wv4 Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) |
High EPSS 0.26% |
< 3.1.0 | 3.1.0 |
| GHSA-xhmj-rg95-44hv Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox |
High EPSS 0.23% |
< 3.1.0 | 3.1.0 |
| GHSA-cvrr-qhgw-2mm6 Flowise: Parameter Override Bypass Remote Command Execution |
Critical EPSS 17.44% |
< 3.1.0 | 3.1.0 |
| GHSA-9wc7-mj3f-74xv Flowise: Code Injection in CSVAgent leads to Authenticated RCE |
High EPSS 1.45% |
< 3.1.0 | 3.1.0 |
| GHSA-f228-chmx-v6j6 Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`. |
High EPSS 0.60% |
< 3.1.0 | 3.1.0 |
| GHSA-9hrv-gvrv-6gf2 Flowise Execute Flow function has an SSRF vulnerability |
High EPSS 0.32% |
< 3.1.0 | 3.1.0 |
| GHSA-qqvm-66q4-vf5c Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) |
Critical EPSS 0.40% |
< 3.1.0 | 3.1.0 |
| GHSA-w6v6-49gh-mc9w Flowise: Path Traversal in Vector Store basePath |
Medium EPSS 0.50% |
< 3.1.0 | 3.1.0 |
| GHSA-c9gw-hvqq-f33r Flowise: Authenticated RCE Via MCP Adapters |
Critical EPSS 11.96% |
< 3.1.0 | 3.1.0 |
| GHSA-fvcw-9w9r-pxc7 Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access |
High EPSS 2.44% |
< 3.0.13 | 3.0.13 |
| GHSA-j44m-5v8f-gc9c Flowise is vulnerable to arbitrary file exposure through its ReadFileTool |
High EPSS 13.87% |
< 3.0.8 | 3.0.8 |
| GHSA-jv9m-vf54-chjj Flowise is vulnerable to arbitrary file write through its WriteFileTool |
Critical EPSS 13.87% |
< 3.0.8 | 3.0.8 |
| GHSA-gjx9-wg9x-7gvp Flowise Vulnerable to SQL Injection via `tableName` Parameter |
High EPSS 0.32% |
< 2.2.4 | 2.2.4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor