AI Sec Watch

Flowise has a security flaw in its GET /api/v1/upsert-history endpoint (an API endpoint, or a web address the software exposes for requests) that returns the entire server-wide history of data uploads instead of limiting it to each user's own data. The response exposes sensitive configuration details like database URLs and collection names, which could help attackers target the system more effectively.

Flowise has a cross-workspace credential vulnerability where attackers can access other users' OpenAI API keys if they know the credential ID. The server doesn't check whether credentials belong to the attacker's workspace before using them, allowing unauthorized access to victim OpenAI accounts and vector stores (collections of data used for AI search and retrieval).

A vulnerability (CVE-2026-18830) was found in Amazon Bedrock's AgentCore harness that allowed authenticated users to run configured tools without the AI model reviewing the request first, bypassing security controls. The issue only affected tools that were already set up on a given harness, so systems with no tools configured were not at risk.

Flowise's CSVAgent has a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability because it takes user-supplied data from a CSV file URI, inserts it directly into Python code without checking it, and then executes that code. Since the Python environment (Pyodide, a tool that runs Python in JavaScript) can access JavaScript functions like `eval` and file operations, an attacker can break out of the Python code, run JavaScript commands, and gain full control of the server, even without authentication.

Flowise has a security flaw where authenticated users can write files anywhere on the server's filesystem through the S3 Directory document loader. The vulnerability occurs because the code doesn't check for path traversal sequences (like `../` which moves up directories) when processing S3 object keys, allowing an attacker to write files outside the intended temporary directory.

Flowise has a privilege bypass vulnerability where users without permission to view workspace variables can still access them through the /api/v1/node-custom-function endpoint, which automatically injects $vars (a map containing all workspace variable names and values, including secrets from environment variables) into custom JavaScript code without checking permissions.

YouTuber Hank Green announced he is stepping back from production after criticism over his use of AI, describing his AI usage as 'not healthy' even though he only used it to find research sources, not write scripts. The backlash highlights concerns creators face when using AI technology that is trained on others' uncompensated work and is known for generating convincing false information, especially when their brand is built on authenticity and credibility.

# Summary Flowise, a platform that uses Pyodide (Python running in the browser), has a security vulnerability where its Python code validator can be bypassed using Unicode homoglyphs (visually similar characters). An attacker can craft malicious Python code with characters like "𝐚" (mathematical bold a) that look like regular letters but bypass the blacklist, allowing them to execute arbitrary Python and OS commands on the Flowise server through Pyodide's JavaScript interop. This re-introduces

AWS has renewed its Payment Card Industry Data Security Standard (PCI DSS, a set of security requirements for handling credit card data) and Three Domain Secure (3DS, a security protocol for online card payments) certifications, expanding coverage to include three new services (Amazon Bedrock AgentCore, AWS Parallel Computing Service, and AWS Skill Builder) and one new region (Asia Pacific – New Zealand). This certification allows customers to use these AWS services while remaining compliant with payment card security regulations, and includes documentation like an Attestation of Compliance (AOC, a formal validation statement) and a Responsibility Summary to clarify what AWS and customers each must do to maintain security.