flowise-components vulnerabilities
CVEs whose affected-version data names the flowise-components package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-73487CriticalFlowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
▾ Midnightflowise · flowiseEPSS 0.96%via GHSA
CVE-2026-73483CriticalFlowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
▾ Midnightflowise · flowiseEPSS 0.62%via GHSA
GHSA-6j9g-8fxc-25hqCritical· 8.8Duplicate Advisory: Flowise contains an unauthenticated sandbox escape
Duplicate Advisory: Flowise contains an unauthenticated sandbox escape
▾ Midnightflowise · flowisevia GHSA
GHSA-88pr-878c-24wfHighFlowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys
Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys
▾ Twilightflowise-components · flowise-componentsvia GHSA
CVE-2026-56275Medium· 7.1Flowise Execute Flow function has an SSRF vulnerability
Flowise Execute Flow function has an SSRF vulnerability
▾ Sunlitflowise · flowiseEPSS 0.32%via GHSA