AI & LLM Vulnerabilities

Flowise has a security flaw where an unauthenticated endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) can refresh OAuth2 tokens (credentials that allow apps to act on behalf of a user) without requiring login. An attacker who knows a credential ID can call this endpoint to get a fresh access token and use it to impersonate the victim on connected services like Google or Microsoft.

Flowise version 3.1.1 has a vulnerability where attackers can use prompt injection (tricking an AI by hiding instructions in its input) on a CSV Agent node to make the LLM generate malicious Python code that bypasses the security blocklist validator and runs with full system access in an unsandboxed pyodide environment (a Python runtime in JavaScript). This allows remote code execution without requiring authentication.

Flowise's CSVAgent has a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability because it takes user-supplied data from a CSV file URI, inserts it directly into Python code without checking it, and then executes that code. Since the Python environment (Pyodide, a tool that runs Python in JavaScript) can access JavaScript functions like `eval` and file operations, an attacker can break out of the Python code, run JavaScript commands, and gain full control of the server, even without authentication.

# Summary Flowise, a platform that uses Pyodide (Python running in the browser), has a security vulnerability where its Python code validator can be bypassed using Unicode homoglyphs (visually similar characters). An attacker can craft malicious Python code with characters like "𝐚" (mathematical bold a) that look like regular letters but bypass the blacklist, allowing them to execute arbitrary Python and OS commands on the Flowise server through Pyodide's JavaScript interop. This re-introduces

Flowise AI versions up to 3.1.2 have a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability in the SQLite Record Manager node. An attacker can override the database file path through the `additionalConfig` input and write an SQLite database to arbitrary locations on the system, including sensitive directories, especially dangerous when Flowise runs as root in Docker containers.

Flowise's CSVAgent node allows users to write Python code that gets executed, but its security filter (a denylist blocking dangerous functions) can be bypassed using `pandas.read_pickle()`, a function that deserializes pickled data and can be exploited to run arbitrary code without triggering the filter.

Flowise version 3.1.2 contains a critical remote code execution vulnerability in its CSV Agent component. An attacker can inject Python code through unsanitized base64 string interpolation, which then uses Pyodide (a tool that runs Python in the browser/JavaScript environments) to access Node.js system functions and execute arbitrary commands as the root user. This vulnerability has been verified with actual exploit code that established a reverse shell session.

Flowise contains a sandbox escape vulnerability in the executeJavaScriptCode() function that allows authenticated users to run arbitrary system commands as root. The function uses JavaScript's spread operator to merge user-provided nodeVMOptions with default security settings, letting attackers override the restricted module list and re-enable dangerous modules like child_process (which runs system commands) and fs (which accesses files).

Flowise, a low-code platform for building AI applications, contains a sandbox escape vulnerability that allows attackers to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own) through custom JavaScript execution. The vulnerability exploits a weakness in how Flowise uses the vm2 sandbox (a deprecated JavaScript isolation library) combined with a bypass of the CVE-2022-24785 patch in the moment library, which was supposed to prevent malicious file path access.

Flowise AI version 3.1.2 has a critical vulnerability where several database connection nodes (MySQL, PostgreSQL, SQLite, and Agent Memory components) allow users to set arbitrary options through an `additionalConfig` input that gets passed to TypeORM's DataSource class. Since TypeORM's DataSource options support loading local files as JavaScript code, an attacker can exploit this to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own) by crafting malicious configuration options.

CVE-2026-18655 is a vulnerability in AWS Amazon MQ MCP Server (a tool that lets AI assistants communicate with Amazon MQ message brokers) versions 2.0.23 and earlier. An attacker can use prompt injection (tricking the AI by hiding instructions in its input) to trick the server into sending broker credentials or OAuth tokens (keys that prove you have permission to access a service) to a fake endpoint they control.

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 has a code injection vulnerability (CWE-94, where improper handling of user input allows attackers to run arbitrary code on the system), which could let remote attackers execute malicious code. The vulnerability stems from inadequate validation and control of user-supplied input that gets processed as code.

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.1 has a vulnerability in its PythonREPL sandbox implementation where it doesn't properly validate user input, potentially allowing code injection (inserting malicious code into a program). This could allow attackers to execute arbitrary code through the affected sandbox component.

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.1 have a security flaw that allows attackers to run arbitrary code without authentication by injecting malicious environment variables (settings that control how programs behave) through the MCP (Model Context Protocol) launcher. The vulnerability exists because the security blocklist protecting against dangerous environment variables is incomplete, missing SHELLOPTS, BASHOPTS, and PS4.

Flyto2 Core has a file-writing vulnerability in `image.download` and 12 other file-writing modules (like `image.convert`, `document.pdf_fill_form`, etc.) that allows attackers to write files anywhere on the system. The problem is that these modules check whether the target file is within a base directory, but the attacker controls both the target file path and the base directory parameter, making the check useless. For example, if an attacker sets `output_dir='/'`, any target path passes the validation, and the attacker's data (from a URL or format operation) gets written to any location the process can access.

The @prompty/core Nunjucks renderer (a template engine for the Prompty framework) had a critical vulnerability where it could execute arbitrary JavaScript code when processing untrusted template files. An attacker could use special template syntax to access internal JavaScript properties and run malicious code on the server.

CVE-2026-50517 is a vulnerability in Microsoft 365 Copilot where deserialization (the process of converting stored data back into usable objects) of untrusted data allows an authorized attacker to execute code over a network. This means someone with legitimate access to the system could run malicious commands remotely by sending specially crafted data to the application.

h2oGPT versions up to 0.2.1 have a path traversal vulnerability (a flaw where attackers can navigate outside intended directories by using special path sequences) in its OpenAI-compatible files API that allows unauthenticated attackers to read, write, and delete files on the server. The vulnerability exists because the bearer token (a type of authentication credential) is used directly in file paths without validation, and the default API key is empty, so attackers can bypass authentication and potentially run arbitrary code by modifying startup files.

A critical vulnerability (CVE-2026-60227) exists in Oracle Coherence, a data management product used in Oracle Fusion Middleware. An attacker without authentication (login credentials) can exploit this flaw over the network to take complete control of the system, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability has a CVSS score (a 0-10 rating of how severe a vulnerability is) of 9.8, indicating it is extremely dangerous.

A critical vulnerability in Oracle Coherence (a distributed computing product) allows attackers without authentication to take over the system through a network connection, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability has a CVSS score (a 0-10 rating of how severe a vulnerability is) of 9.8, indicating it is extremely serious and impacts confidentiality, integrity, and availability of the system. An unauthenticated attacker (someone without login credentials) only needs network access to exploit it.