Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-53950

  CVE-2026-53950: @tryghost/activitypub Stored XSS via Federated Post Content

  Ghost's ActivityPub feed rendered HTML from remote Fediverse servers without sanitization, letting a malicious server inject and run arbitrary JavaScript in a Ghost admin's browser.

• highCVE-2026-70492

  CVE-2026-70492: open-webui Stored XSS via KaTeX Render-Error Fallback

  A chat message crafted to crash the KaTeX math renderer causes Open WebUI to paste raw HTML from the message directly into the page, letting any authenticated user run JavaScript in a viewer's…

• highCVE-2026-70485

  CVE-2026-70485: Open WebUI NAT64-Encoded SSRF Filter Bypass

  Any authenticated Open WebUI user on a NAT64-capable network can wrap a private or cloud-metadata IPv4 address inside a NAT64 IPv6 prefix to bypass the server's SSRF filter and read internal service…

• criticalCVE-2026-70477

  CVE-2026-70477: Flowise CSV Agent Prompt Injection Remote Code Execution

  An unauthenticated attacker can send a crafted prompt to any Flowise chatflow using the CSV Agent node and cause it to execute arbitrary OS commands on the server, because LLM-generated Python code…

• highCVE-2026-70479

  CVE-2026-70479: open-webui SSRF via Unvalidated Sub-Resource Requests in Playwright Web Loader

  When Open WebUI's Playwright web loader is enabled, any authenticated user can make the browser fetch internal addresses like cloud metadata endpoints by embedding sub-resource requests in a page…

• highCVE-2026-70475

  CVE-2026-70475: Flowise Missing Authorization on Execution Update Endpoint

  Any authenticated Flowise user, regardless of their role, could overwrite the state and data of any workflow execution because the PUT endpoint had no permission check.

• highCVE-2026-70476

  CVE-2026-70476: Flowise Broken Access Control in Stripe Billing Endpoints

  Any authenticated Flowise user can change or cancel another organization's paid Stripe subscription by simply swapping the subscription ID in a billing API request.

• highCVE-2026-70473

  CVE-2026-70473: Flowise Server-Wide Upsert History Information Disclosure

  Any authenticated Flowise user can call a single API endpoint and receive the entire server's vector-store upsert history, including infrastructure URLs, API keys, and configuration details belonging…

• criticalCVE-2026-70470

  CVE-2026-70470: Flowise Pyodide Validator Unicode Homoglyph Bypass RCE

  Flowise's Python code validator can be tricked with Unicode lookalike characters, letting anyone who can reach a CSV Agent or Airtable Agent chatflow run arbitrary OS commands on the server.

• highCVE-2026-70472

  CVE-2026-70472: Flowise Cross-Workspace Credential IDOR in OpenAI Assistants Vector Store

  Any authenticated Flowise user with assistant permissions can supply a different workspace's credential ID to the OpenAI assistants vector-store API, letting them read, modify, or delete another…

• highCVE-2026-70471

  CVE-2026-70471: Flowise RBAC Bypass Leading to Workspace Variables Disclosure

  A low-privilege Flowise user can call the custom-function execution endpoint to read all workspace variables, including secrets resolved from server environment variables, even when their role…

• high

  Flowise: Authenticated Arbitrary File Write via S3 Directory Loader Path Traversal

  An authenticated Flowise user can trick the S3 Directory document loader into writing files anywhere on the server by using path-traversal sequences as S3 object keys, with no CVE assigned yet.