30
35
30
30
30
ZDI-26-545: Flowise CSV_Agent customReadCSV Code Injection Remote Code Execution Vulnerability
ZDI discloses CVE-2026-69256, a CVSS 8.8 code injection in Flowise CSV_Agent customReadCSV allowing authenticated remote attackers to execute arbitrary code.
ZDI advisory ZDI-26-545 describes a code injection vulnerability in Flowise's CSV_Agent customReadCSV functionality, tracked as CVE-2026-69256 with a CVSS score of 8.8. It allows remote attackers to execute arbitrary code on affected Flowise installations. Authentication is required to exploit the vulnerability.
40
30
30
30
30
30
30
30
30
30
30
30
35
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
ZDI-26-648: (Pwn2Own) OpenAI Codex External Control of System or Configuration Setting Remote Code Execution Vulnerability
ZDI published a Pwn2Own advisory for CVE-2026-19590, enabling remote code execution in OpenAI's Codex agent via system or configuration control.
Zero Day Initiative advisory ZDI-26-648 documents an External Control of System or Configuration Setting vulnerability in OpenAI Codex, demonstrated at Pwn2Own. A remote attacker could achieve arbitrary code execution, with user interaction required such as opening malicious content. The flaw is tracked as CVE-2026-19590 with a CVSS rating of 7.8. No exploitation in the wild is reported.
52
30
30