Vulnerabilities

Flowise 3.1.2 contains an improper code generation control flaw (CWE-94, code injection) in its /api/v1/prediction/ API endpoint. A remote, unauthenticated attacker can send a crafted request to this endpoint to execute arbitrary code on the server hosting Flowise, achieving full confidentiality, integrity, and availability impact (CVSS 9.8) under the application's privileges. Only version 3.1.2 is named in the available data; the full range of affected versions and any patched release are not specified. As of the provided data, the issue is not listed in CISA's KEV and no public proof-of-concept or confirmed in-the-wild exploitation is known. The critical rating reflects that the flaw is network-reachable with no privileges or user interaction required.

Do: Inventory Flowise deployments and identify any running version 3.1.2; upgrade to a patched release as soon as the vendor publishes one (no fixed version is named in the current data), and monitor the Flowise GitHub repository for an official advisory. Until patched, restrict access to /api/v1/prediction/ by enforcing authentication, binding the service to internal interfaces, or adding reverse-proxy/firewall rules. Review logs for unexpected or unauthenticated requests to that endpoint as a sign of probing or exploitation.

The league/commonmark PHP Markdown parsing library (versions >= 1.5.0 and < 2.9.1) contains quadratic parsing complexity (CWE-407) in its SmartPunctExtension and AttributesExtension. The flaw is only triggered when one of these extensions is explicitly registered on a custom Environment — they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters — and an unauthenticated attacker who can submit Markdown to such a deployment can trigger it with small crafted documents (e.g., text alternating with unpaired quotes, runs of block-level attribute blocks, or repeated class attributes). The attacker gains a denial of service: disproportionate CPU consumption degrades or stalls the rendering process, with no confidentiality or integrity impact (CVSS 4.0 8.7 High, availability-only). Affected parties are PHP applications and services that use the library in the affected range and have either extension explicitly enabled while accepting untrusted Markdown. There is currently no known exploitation, no public proof-of-concept, no entry in CISA KEV, and a low EPSS score of 0.3%.

Do: Upgrade league/commonmark to 2.9.1 or later. If upgrading is not immediately possible, remove or unregister the SmartPunct and Attributes extensions from custom Environments, or rate-limit/CPU-limit rendering of untrusted Markdown. Audit composer dependency trees for versions >= 1.5.0 and < 2.9.1 and review Environment configuration for SmartPunctExtension or AttributesExtension usage.

Gitea before 1.27.1 contains a critical code injection flaw (CWE-94) in the diffpatch API that allows remote code execution by causing the installation of a Git hook. An attacker can submit a crafted request through the diffpatch API to plant a Git hook, which then executes arbitrary shell commands on the server when Git operations run; the CVSS vector indicates the attack requires no authentication or user interaction, while public reporting describes attackers with repository write access planting hooks to run shell commands. Successful exploitation yields full server compromise (confidentiality, integrity, and availability all rated high), and observed attacks have reportedly dropped a cryptocurrency miner. All Gitea deployments running versions prior to 1.27.1 are affected, with internet-facing instances at greatest risk; public scans identified over 8,300 vulnerable Gitea servers. The flaw is actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-25, and EPSS estimates an 86.8% probability of exploitation within 30 days.

Do: Upgrade Gitea to version 1.27.1 or later immediately; organizations subject to BOD 26-04 must apply the vendor mitigation or discontinue use of unpatched cloud-hosted instances. Until patched, limit internet exposure of Gitea servers and inspect repository hook directories for unauthorized or recently modified hooks that could serve as persistence. Check for signs of compromise, including unexpected processes or cryptocurrency-miner activity, since in-the-wold attacks reportedly deploy a miner.

GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29581.

Flowise versions 3.1.2 and earlier contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox (CWE-78) that allows code to break out of the intended isolation and execute on the host. An authenticated user with access to the /api/v1/node-custom-function endpoint triggers the flaw by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally calls child_process.spawn() outside the sandbox boundary. Successful exploitation yields arbitrary OS command execution as the Flowise process user (root in the official Docker image) as well as arbitrary host file disclosure through Chromium's file:// URL handling. All deployments at or below 3.1.2 are affected; versions 3.0.8 through 3.1.2 are only exploitable when ALLOW_BUILTIN_DEP=true, while earlier versions are exploitable by default. No in-the-wild exploitation is currently known (not in CISA KEV, EPSS about 0.6%), but a public advisory with a proof-of-concept reference exists and the flaw is fixed in 3.1.3.

Do: Upgrade Flowise (both flowise and flowise-components packages) to 3.1.3 or later. If upgrading is not immediately possible on 3.0.8-3.1.2, ensure ALLOW_BUILTIN_DEP is not enabled, and in all cases restrict /api/v1/node-custom-function to fully trusted users and avoid exposing Flowise to unauthenticated or low-trust accounts. Review process and API logs for unexpected child process spawns or Chromium launches with unusual executablePath/args, since these would indicate exploitation.

Flowise versions 2.2.4 through 3.1.4 contain a missing-authorization flaw (CWE-862) in the POST /api/v1/openai-assistants-file/download endpoint, which is listed in the product's global authentication whitelist and therefore skips all session and API key verification. An unauthenticated attacker can call the endpoint with valid chatflowId, chatId, and fileName identifiers to download files from any chatflow on the instance, including private chatflows belonging to other workspaces or organizations. The attacker gains unauthorized read access to potentially sensitive chatbot files, crossing user, workspace, and organization boundaries with no privileges or user interaction required. Any deployment running an affected Flowise version is exposed, particularly self-hosted instances reachable over a network by untrusted users. Exploitation has not been confirmed in the wild: the flaw is not in CISA KEV, EPSS assigns a 0.7% 30-day exploitation probability, and one public proof-of-concept is available.

Do: Upgrade Flowise to a patched release newer than 3.1.4; as an interim mitigation, remove POST /api/v1/openai-assistants-file/download from the global authentication whitelist or restrict network access to the instance. Review access logs for unauthenticated calls to this endpoint and treat files served by any chatflow, including other workspaces' private ones, as potentially disclosed.

Flowise through version 3.1.4 contains an authentication bypass (CWE-862) caused by prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. An unauthenticated attacker can send a POST request to the OAuth2 credential refresh route with a trailing credential identifier, which slips past the whitelist check and bypasses all authentication and authorization controls. This triggers unauthorized OAuth token rotation against credentials belonging to any workspace, and the repeated forced refreshes can disrupt or invalidate dependent OAuth integrations relying on those credentials. The flaw affects any self-hosted Flowise deployment up to and including 3.1.4 where the server API is reachable by untrusted parties, and it is a bypass of the incomplete fix for CVE-2026-41273. A public proof-of-concept write-up exists, EPSS is currently low (0.4%), and there is no evidence of exploitation in the wild or a CISA KEV listing.

Do: Upgrade Flowise to a version newer than 3.1.4 that corrects the middleware whitelist matching (verify the fix notes reference CVE-2026-70636, since 3.1.4's fix for CVE-2026-41273 is insufficient). Until patched, restrict network access to the Flowise server API (bind to internal interfaces, enforce VPN/IP allowlisting, and require an auth proxy) and treat previously configured OAuth2 credentials as potentially rotated by an attacker — review refresh/audit logs for unexpected token rotations and re-authorize any dependent OAuth integrations that break.

Flowise versions before 3.1.3 validate attacker-supplied Python code with an ASCII word-boundary blacklist regex in validatePythonCodeForDataFrame, which gates pyodide.runPythonAsync in the CSV Agent and Airtable Agent nodes. Because JavaScript regex word boundaries are ASCII-only while Python 3 NFKC-normalizes identifiers at parse time, homoglyph forms such as __cl𝐚ss__, __subcl𝐚sses__, and __b𝐮iltins__ slip past the blacklist and are parsed as their dangerous ASCII equivalents. An unauthenticated attacker who can submit code to these agent nodes gains arbitrary Python execution inside Pyodide and, via Pyodide's JS module interop, full OS command execution on the Flowise host (CVSS 4.0: 9.5, no privileges or user interaction required). Self-hosted Flowise deployments running any version prior to 3.1.3 with the vulnerable agent nodes reachable are affected; the issue is fixed in 3.1.3. A public GitHub security advisory documents the technical details, but EPSS is low (0.8% over 30 days), the flaw is not in CISA's KEV, and no exploitation in the wild is known.

Do: Upgrade Flowise to version 3.1.3 or later immediately. Until patched, place Flowise behind authentication and network access controls so untrusted users cannot reach the CSV Agent or Airtable Agent nodes, and consider disabling those nodes. Review host logs for unexpected Python or OS command execution originating from the Flowise process, and rotate any secrets or API keys accessible from the host.

SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active to execute operations with hijacked user privileges.