All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Flowise has a privilege bypass vulnerability where users without permission to view workspace variables can still access them through the /api/v1/node-custom-function endpoint, which automatically injects $vars (a map containing all workspace variable names and values, including secrets from environment variables) into custom JavaScript code without checking permissions.
Fix: The source recommends: 'Do not inject $vars unless the caller is authorized: enforce variables:view before injecting $vars, or inject only an explicit allowlist of variables needed for the function.' It also suggests considering disabling or restricting runtime type variables (which map to process.env values) in self-hosted environments.
GitHub Advisory Database# Summary Flowise, a platform that uses Pyodide (Python running in the browser), has a security vulnerability where its Python code validator can be bypassed using Unicode homoglyphs (visually similar characters). An attacker can craft malicious Python code with characters like "𝐚" (mathematical bold a) that look like regular letters but bypass the blacklist, allowing them to execute arbitrary Python and OS commands on the Flowise server through Pyodide's JavaScript interop. This re-introduces
AWS has renewed its Payment Card Industry Data Security Standard (PCI DSS, a set of security requirements for handling credit card data) and Three Domain Secure (3DS, a security protocol for online card payments) certifications, expanding coverage to include three new services (Amazon Bedrock AgentCore, AWS Parallel Computing Service, and AWS Skill Builder) and one new region (Asia Pacific – New Zealand). This certification allows customers to use these AWS services while remaining compliant with payment card security regulations, and includes documentation like an Attestation of Compliance (AOC, a formal validation statement) and a Responsibility Summary to clarify what AWS and customers each must do to maintain security.
Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8 have a bug where the admin interface displays URLField (a field for storing web addresses) values as clickable links without checking if the URLs are safe, allowing cross-site scripting (injecting malicious code that runs in a user's browser). The vulnerability only affects applications that store invalid URL data directly in the database without running validation checks, such as through bulk imports or direct database writes.
This is a brief announcement about 'llm 0.32', a beat (news update) posted by Simon Willison on August 4th, 2026. The post mentions a monthly briefing service where subscribers can pay $10/month to receive a curated email digest of important LLM developments.
Flowise 3.1.1 has a security bypass in its patch for CVE-2025-8943. The patch blocks dangerous command-line flags (like `-y` and `--yes`) to prevent automatic package installation, but attackers can bypass this by setting the `npm_config_yes` environment variable (a way to pass configuration to npm through the environment rather than command-line flags), which achieves the same effect. On unprotected Flowise deployments without authentication, this allows unauthenticated remote code execution (running arbitrary commands on the server).
Flowise has a permission validation bug in its delete endpoint for chat flows. The endpoint checks if a user has either `chatflows:delete` or `agentflows:delete` permission (authorization levels that control who can delete different types of workflow configurations), but it doesn't verify that the permission matches the actual type of resource being deleted. This means someone with only `agentflows:delete` permission can delete a chatflow, and vice versa, breaking the intended access control separation between these two resource types.
Flowise AI versions up to 3.1.2 have a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability in the SQLite Record Manager node. An attacker can override the database file path through the `additionalConfig` input and write an SQLite database to arbitrary locations on the system, including sensitive directories, especially dangerous when Flowise runs as root in Docker containers.
Flowise has a security vulnerability in its unauthenticated prediction API endpoint where an attacker can inject arbitrary properties through an `overrideConfig` object (a set of configuration overrides) into the flow execution context without proper access checks. This allows attackers to manipulate chat sessions, steal conversation history, and inject malicious values into template variables that flow nodes use, even though a similar vulnerability was supposedly fixed in an earlier patch.
Flowise has a critical security flaw in its SSRF (server-side request forgery, a vulnerability where an attacker tricks a server into making requests to unintended targets) protection that fails to properly check IPv4-mapped IPv6 addresses (a format like ::ffff:127.0.0.1 that disguises IPv4 addresses as IPv6). Because the code compares address types without converting them to a common format, attackers who control DNS records can bypass all IP-based access restrictions and reach internal services or cloud metadata endpoints.
Flowise's CSVAgent node allows users to write Python code that gets executed, but its security filter (a denylist blocking dangerous functions) can be bypassed using `pandas.read_pickle()`, a function that deserializes pickled data and can be exploited to run arbitrary code without triggering the filter.
Flowise version 3.1.2 contains a critical remote code execution vulnerability in its CSV Agent component. An attacker can inject Python code through unsanitized base64 string interpolation, which then uses Pyodide (a tool that runs Python in the browser/JavaScript environments) to access Node.js system functions and execute arbitrary commands as the root user. This vulnerability has been verified with actual exploit code that established a reverse shell session.
Flowise contains a sandbox escape vulnerability in the executeJavaScriptCode() function that allows authenticated users to run arbitrary system commands as root. The function uses JavaScript's spread operator to merge user-provided nodeVMOptions with default security settings, letting attackers override the restricted module list and re-enable dangerous modules like child_process (which runs system commands) and fs (which accesses files).
marimo (a Python notebook tool) before version 0.23.15 has a configuration injection vulnerability (a flaw where untrusted settings override safe ones) that lets notebook creators steal API keys. An attacker can hide a malicious base_url (the server address an AI request goes to) in notebook metadata, and when an operator opens the notebook and makes an AI request, marimo sends the operator's OpenAI API key to the attacker's server instead of the legitimate one, without requiring any code to actually run.
Flowise, a low-code platform for building AI applications, contains a sandbox escape vulnerability that allows attackers to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own) through custom JavaScript execution. The vulnerability exploits a weakness in how Flowise uses the vm2 sandbox (a deprecated JavaScript isolation library) combined with a bypass of the CVE-2022-24785 patch in the moment library, which was supposed to prevent malicious file path access.
Flowise has a missing authorization bug in the `/api/v1/files` endpoint that allows any API key within an organization to list and delete files from other workspaces, even if that API key has no permission to access files. The endpoint only checks if files are enabled as a feature, but does not verify that the API key has permission to access files in that specific workspace, breaking the isolation between workspaces.
Flowise AI version 3.1.2 has a critical vulnerability where several database connection nodes (MySQL, PostgreSQL, SQLite, and Agent Memory components) allow users to set arbitrary options through an `additionalConfig` input that gets passed to TypeORM's DataSource class. Since TypeORM's DataSource options support loading local files as JavaScript code, an attacker can exploit this to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own) by crafting malicious configuration options.
YouTuber Hank Green announced he is stepping back from production after criticism over his use of AI, describing his AI usage as 'not healthy' even though he only used it to find research sources, not write scripts. The backlash highlights concerns creators face when using AI technology that is trained on others' uncompensated work and is known for generating convincing false information, especially when their brand is built on authenticity and credibility.
Fix: Update Django to version 5.2.17 or 6.0.8 or later.
NVD/CVE DatabaseAirlock Digital announced a new security tool called Agentic AI Control & Governance that helps organizations monitor and control what AI agents (autonomous software programs that act on behalf of users) do once they start running on company computers. Traditional endpoint security only decides whether software is allowed to run, but this new tool adds a second layer by setting boundaries on what trusted AI agents can actually do and ensuring they follow company policies.
Organizations struggle to protect sensitive data when employees use AI tools because traditional security tools like CASB (cloud access security brokers, which control who can access cloud applications) and DLP (data loss prevention, which blocks sensitive information from leaving an organization) focus on whether users can access an app, not on what they actually say to the AI or what it does with that information. The real risk appears in the conversation itself, where users might accidentally share confidential details across multiple prompts in ways that don't match standard security rules.
Fix: The source text provides three explicit remediation options: (1) Best option: Use `pyodide.globals.set('base64_string', base64String)` instead of string interpolation. (2) Validate base64 before interpolation by rejecting any string that does not match the pattern `/^[A-Za-z0-9+/=]*$/`. (3) Escape special characters (`"`, `\n`, `\r`, `\\`) before interpolation into the Python code.
GitHub Advisory DatabaseFix: Upgrade marimo to version 0.23.15 or later.
NVD/CVE Database