Browse All

ChainDrop is a self-propagating malware attack that infected 444 npm packages (software libraries used by developers) with over 2 billion monthly downloads combined, starting with a compromised GitHub account belonging to a popular package maintainer. The malware steals credentials, configuration files, and secrets from developers' machines, including AI assistant credentials and cloud access tokens, and uses the Ethereum blockchain for command and control (a technique called EtherHiding). This is a new variant of Shai-Hulud, a supply-chain worm (malware that spreads through software dependencies) that has targeted code repositories since last year.

Flowise has a security flaw where an unauthenticated endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) can refresh OAuth2 tokens (credentials that allow apps to act on behalf of a user) without requiring login. An attacker who knows a credential ID can call this endpoint to get a fresh access token and use it to impersonate the victim on connected services like Google or Microsoft.

Flowise version 3.1.1 has a vulnerability where attackers can use prompt injection (tricking an AI by hiding instructions in its input) on a CSV Agent node to make the LLM generate malicious Python code that bypasses the security blocklist validator and runs with full system access in an unsandboxed pyodide environment (a Python runtime in JavaScript). This allows remote code execution without requiring authentication.

Flowise's CSVAgent has a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability because it takes user-supplied data from a CSV file URI, inserts it directly into Python code without checking it, and then executes that code. Since the Python environment (Pyodide, a tool that runs Python in JavaScript) can access JavaScript functions like `eval` and file operations, an attacker can break out of the Python code, run JavaScript commands, and gain full control of the server, even without authentication.

# Summary Flowise, a platform that uses Pyodide (Python running in the browser), has a security vulnerability where its Python code validator can be bypassed using Unicode homoglyphs (visually similar characters). An attacker can craft malicious Python code with characters like "𝐚" (mathematical bold a) that look like regular letters but bypass the blacklist, allowing them to execute arbitrary Python and OS commands on the Flowise server through Pyodide's JavaScript interop. This re-introduces

Flowise AI versions up to 3.1.2 have a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability in the SQLite Record Manager node. An attacker can override the database file path through the `additionalConfig` input and write an SQLite database to arbitrary locations on the system, including sensitive directories, especially dangerous when Flowise runs as root in Docker containers.

Flowise's CSVAgent node allows users to write Python code that gets executed, but its security filter (a denylist blocking dangerous functions) can be bypassed using `pandas.read_pickle()`, a function that deserializes pickled data and can be exploited to run arbitrary code without triggering the filter.

Flowise version 3.1.2 contains a critical remote code execution vulnerability in its CSV Agent component. An attacker can inject Python code through unsanitized base64 string interpolation, which then uses Pyodide (a tool that runs Python in the browser/JavaScript environments) to access Node.js system functions and execute arbitrary commands as the root user. This vulnerability has been verified with actual exploit code that established a reverse shell session.

Flowise contains a sandbox escape vulnerability in the executeJavaScriptCode() function that allows authenticated users to run arbitrary system commands as root. The function uses JavaScript's spread operator to merge user-provided nodeVMOptions with default security settings, letting attackers override the restricted module list and re-enable dangerous modules like child_process (which runs system commands) and fs (which accesses files).

Flowise, a low-code platform for building AI applications, contains a sandbox escape vulnerability that allows attackers to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own) through custom JavaScript execution. The vulnerability exploits a weakness in how Flowise uses the vm2 sandbox (a deprecated JavaScript isolation library) combined with a bypass of the CVE-2022-24785 patch in the moment library, which was supposed to prevent malicious file path access.

Flowise AI version 3.1.2 has a critical vulnerability where several database connection nodes (MySQL, PostgreSQL, SQLite, and Agent Memory components) allow users to set arbitrary options through an `additionalConfig` input that gets passed to TypeORM's DataSource class. Since TypeORM's DataSource options support loading local files as JavaScript code, an attacker can exploit this to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own) by crafting malicious configuration options.

A malicious npm package called keyv@6.0.0 spread to hundreds of packages in August 2026, using a preinstall script (code that runs automatically when a package is installed) to steal credentials like passwords and API keys from developer machines and CI environments (continuous integration systems that automatically test and deploy code). The worm could also plant hidden hooks in VS Code and Claude Code editors that execute the malicious code when a developer opens the project.

CVE-2026-18655 is a vulnerability in AWS Amazon MQ MCP Server (a tool that lets AI assistants communicate with Amazon MQ message brokers) versions 2.0.23 and earlier. An attacker can use prompt injection (tricking the AI by hiding instructions in its input) to trick the server into sending broker credentials or OAuth tokens (keys that prove you have permission to access a service) to a fake endpoint they control.

Microsoft had a critical vulnerability in Azure Cosmos DB (a NoSQL database that stores data in the cloud), specifically in its Gremlin API (a tool for managing graph-structured data). Attackers who discovered it could have stolen the Cosmos Master Key, giving them read and write access to any database and a list of all databases on the service. Microsoft patched the issue after being notified by security researchers.

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 has a code injection vulnerability (CWE-94, where improper handling of user input allows attackers to run arbitrary code on the system), which could let remote attackers execute malicious code. The vulnerability stems from inadequate validation and control of user-supplied input that gets processed as code.

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.1 has a vulnerability in its PythonREPL sandbox implementation where it doesn't properly validate user input, potentially allowing code injection (inserting malicious code into a program). This could allow attackers to execute arbitrary code through the affected sandbox component.

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.1 have a security flaw that allows attackers to run arbitrary code without authentication by injecting malicious environment variables (settings that control how programs behave) through the MCP (Model Context Protocol) launcher. The vulnerability exists because the security blocklist protecting against dangerous environment variables is incomplete, missing SHELLOPTS, BASHOPTS, and PS4.

Flyto2 Core has a file-writing vulnerability in `image.download` and 12 other file-writing modules (like `image.convert`, `document.pdf_fill_form`, etc.) that allows attackers to write files anywhere on the system. The problem is that these modules check whether the target file is within a base directory, but the attacker controls both the target file path and the base directory parameter, making the check useless. For example, if an attacker sets `output_dir='/'`, any target path passes the validation, and the attacker's data (from a URL or format operation) gets written to any location the process can access.

A critical vulnerability (CVE-2026-59726, called RufRoot) in the open-source Ruflo AI agent platform allows unauthenticated attackers to take complete control of enterprise AI systems by exploiting an exposed MCP bridge (Model Context Protocol, a system that lets AI agents interact with external tools and data). The flaw affects Ruflo versions before 3.16.3 and has a maximum severity score of 10.0, enabling attackers to execute arbitrary code, steal API keys, hijack AI agents, and manipulate the platform's memory through a single HTTP request.

Ruflo, an open-source platform for building multi-agent AI systems, had a critical vulnerability (CVE-2026-59726, CVSS score 10.0) that allowed unauthenticated attackers to run commands on exposed instances by sending HTTP requests to an unprotected port. Attackers could steal LLM API keys, read user conversations, and poison the AI system's memory (inject false patterns to manipulate how the AI responds) by exploiting this flaw in versions before 3.16.3.