Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
MLflow's AI Gateway has a security flaw where it accepts any web address (api_base) when creating a gateway secret without checking if the address is safe or if it points to internal systems. Any authenticated user, even those with read-only access, can create a secret pointing to internal addresses and use the gateway proxy to reach them, potentially exposing sensitive cloud credentials stored in metadata services (systems that provide configuration information to cloud instances).
Flowise version 3.1.1 has a vulnerability where attackers can use prompt injection (tricking an AI by hiding instructions in its input) on a CSV Agent node to make the LLM generate malicious Python code that bypasses the security blocklist validator and runs with full system access in an unsandboxed pyodide environment (a Python runtime in JavaScript). This allows remote code execution without requiring authentication.
Flowise has a broken access control vulnerability in its billing endpoints that allows an authenticated attacker to manipulate another organization's Stripe subscriptions. The vulnerable endpoints accept subscription identifiers directly from user input without checking that the subscription belongs to the attacker's organization, enabling unauthorized billing operations like changing subscription plans or seat quantities.
Flowise has a missing authorization vulnerability in its execution update endpoint (`PUT /api/v1/executions/:id`). Unlike other execution endpoints that check user permissions, the update endpoint allows any authenticated user to modify any execution record, enabling privilege escalation (gaining higher-level access than intended) where a low-privileged user can change execution data and results.
Flowise has a security vulnerability in its OAuth2 credential handling where three endpoints look up credentials by ID alone without checking which workspace the user belongs to, and two of these endpoints skip authentication entirely. This allows authenticated users to access credentials from other workspaces, and unauthenticated attackers to inject forged OAuth2 tokens or refresh tokens for any credential in the system.
Flowise has a security flaw where the `GET /api/v1/credentials/:id` endpoint returns sensitive data in plaintext to any authenticated user with permission to view credentials. While a redaction function masks fields marked as `type: 'password'`, many credential types store secrets (like database URLs with passwords, Google service account keys, and AWS access keys) in fields marked as `type: 'string'`, which are returned without any protection.
Flowise's CSVAgent has a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability because it takes user-supplied data from a CSV file URI, inserts it directly into Python code without checking it, and then executes that code. Since the Python environment (Pyodide, a tool that runs Python in JavaScript) can access JavaScript functions like `eval` and file operations, an attacker can break out of the Python code, run JavaScript commands, and gain full control of the server, even without authentication.
Flowise has a security flaw where authenticated users can write files anywhere on the server's filesystem through the S3 Directory document loader. The vulnerability occurs because the code doesn't check for path traversal sequences (like `../` which moves up directories) when processing S3 object keys, allowing an attacker to write files outside the intended temporary directory.
Flowise has a privilege bypass vulnerability where users without permission to view workspace variables can still access them through the /api/v1/node-custom-function endpoint, which automatically injects $vars (a map containing all workspace variable names and values, including secrets from environment variables) into custom JavaScript code without checking permissions.
# Summary Flowise, a platform that uses Pyodide (Python running in the browser), has a security vulnerability where its Python code validator can be bypassed using Unicode homoglyphs (visually similar characters). An attacker can craft malicious Python code with characters like "𝐚" (mathematical bold a) that look like regular letters but bypass the blacklist, allowing them to execute arbitrary Python and OS commands on the Flowise server through Pyodide's JavaScript interop. This re-introduces
Flowise 3.1.1 has a security bypass in its patch for CVE-2025-8943. The patch blocks dangerous command-line flags (like `-y` and `--yes`) to prevent automatic package installation, but attackers can bypass this by setting the `npm_config_yes` environment variable (a way to pass configuration to npm through the environment rather than command-line flags), which achieves the same effect. On unprotected Flowise deployments without authentication, this allows unauthenticated remote code execution (running arbitrary commands on the server).
Flowise has a permission validation bug in its delete endpoint for chat flows. The endpoint checks if a user has either `chatflows:delete` or `agentflows:delete` permission (authorization levels that control who can delete different types of workflow configurations), but it doesn't verify that the permission matches the actual type of resource being deleted. This means someone with only `agentflows:delete` permission can delete a chatflow, and vice versa, breaking the intended access control separation between these two resource types.
Flowise AI versions up to 3.1.2 have a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability in the SQLite Record Manager node. An attacker can override the database file path through the `additionalConfig` input and write an SQLite database to arbitrary locations on the system, including sensitive directories, especially dangerous when Flowise runs as root in Docker containers.
Flowise has a security vulnerability in its unauthenticated prediction API endpoint where an attacker can inject arbitrary properties through an `overrideConfig` object (a set of configuration overrides) into the flow execution context without proper access checks. This allows attackers to manipulate chat sessions, steal conversation history, and inject malicious values into template variables that flow nodes use, even though a similar vulnerability was supposedly fixed in an earlier patch.
Flowise has a critical security flaw in its SSRF (server-side request forgery, a vulnerability where an attacker tricks a server into making requests to unintended targets) protection that fails to properly check IPv4-mapped IPv6 addresses (a format like ::ffff:127.0.0.1 that disguises IPv4 addresses as IPv6). Because the code compares address types without converting them to a common format, attackers who control DNS records can bypass all IP-based access restrictions and reach internal services or cloud metadata endpoints.
Flowise's CSVAgent node allows users to write Python code that gets executed, but its security filter (a denylist blocking dangerous functions) can be bypassed using `pandas.read_pickle()`, a function that deserializes pickled data and can be exploited to run arbitrary code without triggering the filter.
Flowise version 3.1.2 contains a critical remote code execution vulnerability in its CSV Agent component. An attacker can inject Python code through unsanitized base64 string interpolation, which then uses Pyodide (a tool that runs Python in the browser/JavaScript environments) to access Node.js system functions and execute arbitrary commands as the root user. This vulnerability has been verified with actual exploit code that established a reverse shell session.
Flowise contains a sandbox escape vulnerability in the executeJavaScriptCode() function that allows authenticated users to run arbitrary system commands as root. The function uses JavaScript's spread operator to merge user-provided nodeVMOptions with default security settings, letting attackers override the restricted module list and re-enable dangerous modules like child_process (which runs system commands) and fs (which accesses files).
Flowise has a missing authorization bug in the `/api/v1/files` endpoint that allows any API key within an organization to list and delete files from other workspaces, even if that API key has no permission to access files. The endpoint only checks if files are enabled as a feature, but does not verify that the API key has permission to access files in that specific workspace, breaking the isolation between workspaces.
Flowise has a vulnerability where the OAuth2 token refresh endpoint is publicly accessible without authentication and makes server-side HTTP requests to attacker-controlled URLs without protections (SSRF, or server-side request forgery, where an attacker tricks a server into making requests on their behalf). This allows attackers to see the full response from their target server and steal sensitive OAuth2 secrets like client IDs and refresh tokens that get sent in the request body.
Fix: The source recommends: 'Do not inject $vars unless the caller is authorized: enforce variables:view before injecting $vars, or inject only an explicit allowlist of variables needed for the function.' It also suggests considering disabling or restricting runtime type variables (which map to process.env values) in self-hosted environments.
GitHub Advisory DatabaseFix: The source text provides three explicit remediation options: (1) Best option: Use `pyodide.globals.set('base64_string', base64String)` instead of string interpolation. (2) Validate base64 before interpolation by rejecting any string that does not match the pattern `/^[A-Za-z0-9+/=]*$/`. (3) Escape special characters (`"`, `\n`, `\r`, `\\`) before interpolation into the Python code.
GitHub Advisory Database