Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• criticalCVE-2026-70470

  CVE-2026-70470: Flowise Pyodide Validator Unicode Homoglyph Bypass RCE

  Flowise's Python code validator can be tricked with Unicode lookalike characters, letting anyone who can reach a CSV Agent or Airtable Agent chatflow run arbitrary OS commands on the server.

• highCVE-2026-70472

  CVE-2026-70472: Flowise Cross-Workspace Credential IDOR in OpenAI Assistants Vector Store

  Any authenticated Flowise user with assistant permissions can supply a different workspace's credential ID to the OpenAI assistants vector-store API, letting them read, modify, or delete another…

• highCVE-2026-70471

  CVE-2026-70471: Flowise RBAC Bypass Leading to Workspace Variables Disclosure

  A low-privilege Flowise user can call the custom-function execution endpoint to read all workspace variables, including secrets resolved from server environment variables, even when their role…

• high

  Flowise: Authenticated Arbitrary File Write via S3 Directory Loader Path Traversal

  An authenticated Flowise user can trick the S3 Directory document loader into writing files anywhere on the server by using path-traversal sequences as S3 object keys, with no CVE assigned yet.

• criticalCVE-2026-69264

  CVE-2026-69264: Flowise CSVAgent Pyodide Code Injection RCE

  Flowise's CSV Agent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python script that runs inside Pyodide, letting anyone who can create a chatflow write files or…

• highCVE-2026-69263

  CVE-2026-69263: Flowise MCP Environment Variable Blocklist Bypass (Unauthenticated RCE)

  A patch meant to stop Flowise from auto-installing arbitrary npm packages can be bypassed by setting npm_config_yes in the MCP server environment, letting an unauthenticated attacker run arbitrary…

• highCVE-2026-69257

  CVE-2026-69257: Flowise SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

  Flowise's SSRF deny list can be completely bypassed by supplying an IPv4-mapped IPv6 address such as ::ffff:169.254.169.254, letting an attacker reach cloud metadata endpoints and internal services…

• highCVE-2026-69258

  CVE-2026-69258: Flowise Unauthenticated Property Injection via Ungated overrideConfig Spread

  Any unauthenticated caller can inject arbitrary properties into a Flowise chatflow's execution context by sending an overrideConfig object to the public prediction API, enabling session hijacking and…

• criticalCVE-2026-69259

  CVE-2026-69259: Flowise SQLite Record Manager Authenticated RCE via Arbitrary File Write

  An authenticated Flowise user can redirect the SQLite Record Manager node to write a crafted database file to any path on the server, including Chromium config directories, and then trigger code…

• criticalCVE-2026-69254

  CVE-2026-69254: Flowise RCE via NodeVM Sandbox Escape in executeJavaScriptCode()

  Any authenticated Flowise user can break out of the JavaScript sandbox and run arbitrary system commands as root by overriding the VM security options that are supposed to block dangerous built-in…

• criticalCVE-2026-69256

  CVE-2026-69256: flowise-components CSVAgent Pickle Deserialization Remote Code Execution

  The Flowise CSVAgent node lets attackers smuggle a malicious pickled payload through the pandas read_pickle() function, bypassing the denylist entirely and running arbitrary OS commands on the server.

• criticalCVE-2026-69253

  CVE-2026-69253: Flowise vm2 Sandbox Escape to RCE via moment locale Injection

  An authenticated attacker can inject arbitrary JavaScript into Flowise's AgentAsTool node by abusing a broken URL validator, escape the vm2 sandbox using a crafted moment.locale() call, and execute…