Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Flowise has a security vulnerability in its OAuth2 credential handling where three endpoints look up credentials by ID alone without checking which workspace the user belongs to, and two of these endpoints skip authentication entirely. This allows authenticated users to access credentials from other workspaces, and unauthenticated attackers to inject forged OAuth2 tokens or refresh tokens for any credential in the system.
Flowise has a security flaw where the `GET /api/v1/credentials/:id` endpoint returns sensitive data in plaintext to any authenticated user with permission to view credentials. While a redaction function masks fields marked as `type: 'password'`, many credential types store secrets (like database URLs with passwords, Google service account keys, and AWS access keys) in fields marked as `type: 'string'`, which are returned without any protection.
Flowise has a security flaw in its GET /api/v1/upsert-history endpoint (an API endpoint, or a web address the software exposes for requests) that returns the entire server-wide history of data uploads instead of limiting it to each user's own data. The response exposes sensitive configuration details like database URLs and collection names, which could help attackers target the system more effectively.
Flowise has a cross-workspace credential vulnerability where attackers can access other users' OpenAI API keys if they know the credential ID. The server doesn't check whether credentials belong to the attacker's workspace before using them, allowing unauthorized access to victim OpenAI accounts and vector stores (collections of data used for AI search and retrieval).
A vulnerability (CVE-2026-18830) was found in Amazon Bedrock's AgentCore harness that allowed authenticated users to run configured tools without the AI model reviewing the request first, bypassing security controls. The issue only affected tools that were already set up on a given harness, so systems with no tools configured were not at risk.
Flowise's CSVAgent has a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability because it takes user-supplied data from a CSV file URI, inserts it directly into Python code without checking it, and then executes that code. Since the Python environment (Pyodide, a tool that runs Python in JavaScript) can access JavaScript functions like `eval` and file operations, an attacker can break out of the Python code, run JavaScript commands, and gain full control of the server, even without authentication.
Flowise has a security flaw where authenticated users can write files anywhere on the server's filesystem through the S3 Directory document loader. The vulnerability occurs because the code doesn't check for path traversal sequences (like `../` which moves up directories) when processing S3 object keys, allowing an attacker to write files outside the intended temporary directory.
Flowise has a privilege bypass vulnerability where users without permission to view workspace variables can still access them through the /api/v1/node-custom-function endpoint, which automatically injects $vars (a map containing all workspace variable names and values, including secrets from environment variables) into custom JavaScript code without checking permissions.
# Summary Flowise, a platform that uses Pyodide (Python running in the browser), has a security vulnerability where its Python code validator can be bypassed using Unicode homoglyphs (visually similar characters). An attacker can craft malicious Python code with characters like "𝐚" (mathematical bold a) that look like regular letters but bypass the blacklist, allowing them to execute arbitrary Python and OS commands on the Flowise server through Pyodide's JavaScript interop. This re-introduces
Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8 have a bug where the admin interface displays URLField (a field for storing web addresses) values as clickable links without checking if the URLs are safe, allowing cross-site scripting (injecting malicious code that runs in a user's browser). The vulnerability only affects applications that store invalid URL data directly in the database without running validation checks, such as through bulk imports or direct database writes.
Flowise 3.1.1 has a security bypass in its patch for CVE-2025-8943. The patch blocks dangerous command-line flags (like `-y` and `--yes`) to prevent automatic package installation, but attackers can bypass this by setting the `npm_config_yes` environment variable (a way to pass configuration to npm through the environment rather than command-line flags), which achieves the same effect. On unprotected Flowise deployments without authentication, this allows unauthenticated remote code execution (running arbitrary commands on the server).
Flowise has a permission validation bug in its delete endpoint for chat flows. The endpoint checks if a user has either `chatflows:delete` or `agentflows:delete` permission (authorization levels that control who can delete different types of workflow configurations), but it doesn't verify that the permission matches the actual type of resource being deleted. This means someone with only `agentflows:delete` permission can delete a chatflow, and vice versa, breaking the intended access control separation between these two resource types.
Flowise AI versions up to 3.1.2 have a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability in the SQLite Record Manager node. An attacker can override the database file path through the `additionalConfig` input and write an SQLite database to arbitrary locations on the system, including sensitive directories, especially dangerous when Flowise runs as root in Docker containers.
Flowise has a security vulnerability in its unauthenticated prediction API endpoint where an attacker can inject arbitrary properties through an `overrideConfig` object (a set of configuration overrides) into the flow execution context without proper access checks. This allows attackers to manipulate chat sessions, steal conversation history, and inject malicious values into template variables that flow nodes use, even though a similar vulnerability was supposedly fixed in an earlier patch.
Flowise has a critical security flaw in its SSRF (server-side request forgery, a vulnerability where an attacker tricks a server into making requests to unintended targets) protection that fails to properly check IPv4-mapped IPv6 addresses (a format like ::ffff:127.0.0.1 that disguises IPv4 addresses as IPv6). Because the code compares address types without converting them to a common format, attackers who control DNS records can bypass all IP-based access restrictions and reach internal services or cloud metadata endpoints.
Flowise's CSVAgent node allows users to write Python code that gets executed, but its security filter (a denylist blocking dangerous functions) can be bypassed using `pandas.read_pickle()`, a function that deserializes pickled data and can be exploited to run arbitrary code without triggering the filter.
Flowise version 3.1.2 contains a critical remote code execution vulnerability in its CSV Agent component. An attacker can inject Python code through unsanitized base64 string interpolation, which then uses Pyodide (a tool that runs Python in the browser/JavaScript environments) to access Node.js system functions and execute arbitrary commands as the root user. This vulnerability has been verified with actual exploit code that established a reverse shell session.
Flowise contains a sandbox escape vulnerability in the executeJavaScriptCode() function that allows authenticated users to run arbitrary system commands as root. The function uses JavaScript's spread operator to merge user-provided nodeVMOptions with default security settings, letting attackers override the restricted module list and re-enable dangerous modules like child_process (which runs system commands) and fs (which accesses files).
marimo (a Python notebook tool) before version 0.23.15 has a configuration injection vulnerability (a flaw where untrusted settings override safe ones) that lets notebook creators steal API keys. An attacker can hide a malicious base_url (the server address an AI request goes to) in notebook metadata, and when an operator opens the notebook and makes an AI request, marimo sends the operator's OpenAI API key to the attacker's server instead of the legitimate one, without requiring any code to actually run.
Flowise, a low-code platform for building AI applications, contains a sandbox escape vulnerability that allows attackers to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own) through custom JavaScript execution. The vulnerability exploits a weakness in how Flowise uses the vm2 sandbox (a deprecated JavaScript isolation library) combined with a bypass of the CVE-2022-24785 patch in the moment library, which was supposed to prevent malicious file path access.
Fix: Update Amazon Bedrock AgentCore harness InvokeHarness API to the version released after July 31, 2026.
AWS Security BulletinsFix: The source recommends: 'Do not inject $vars unless the caller is authorized: enforce variables:view before injecting $vars, or inject only an explicit allowlist of variables needed for the function.' It also suggests considering disabling or restricting runtime type variables (which map to process.env values) in self-hosted environments.
GitHub Advisory DatabaseFix: Update Django to version 5.2.17 or 6.0.8 or later.
NVD/CVE DatabaseFix: The source text provides three explicit remediation options: (1) Best option: Use `pyodide.globals.set('base64_string', base64String)` instead of string interpolation. (2) Validate base64 before interpolation by rejecting any string that does not match the pattern `/^[A-Za-z0-9+/=]*$/`. (3) Escape special characters (`"`, `\n`, `\r`, `\\`) before interpolation into the Python code.
GitHub Advisory DatabaseFix: Upgrade marimo to version 0.23.15 or later.
NVD/CVE Database