Vulnerabilidades em FlowiseAI

113 resultados
Análise Vexday

Com 62 CVEs catalogadas e 38 surgidas apenas nos últimos 90 dias, o FlowiseAI apresenta um ritmo de descoberta de vulnerabilidades consideravelmente acelerado, o que exige atenção contínua de equipes de segurança. Nenhuma das falhas consta atualmente no catálogo KEV da CISA — taxa abaixo da média geral do catálogo —, porém isso não reduz o risco potencial: o CVE-2025-59528 registra um score EPSS de 0,9018, indicando altíssima probabilidade de exploração em ambiente real segundo os modelos preditivos. Das 62 vulnerabilidades, 12 são classificadas como críticas e 3 possuem prova de conceito pública, ampliando a superfície de ataque para agentes mal-intencionados. O tipo de falha mais frequente é CWE-915 (modificação indevida de atributos de objetos de massa), padrão que frequentemente viabiliza bypass de controles de acesso e manipulação de dados sensíveis em aplicações orientadas a fluxos de IA.

CVE-2026-41277HIGHFlowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)EPSS 3.1%CVE-2026-31829HIGHFlowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network AccessEPSS 2.3%CVE-2024-36420HIGHGHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-fileEPSS 1.8%CVE-2026-41137CRITICALFlowise: Code Injection in CSVAgent leads to Authenticated RCEEPSS 1.5%CVE-2026-41264CRITICALFlowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityEPSS 1.4%CVE-2026-69264CRITICALFlowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validationEPSS 1.2%CVE-2026-73487CRITICALFlowise before 3.1.3 Prompt Injection RCE via CSV AgentEPSS 1.0%CVE-2026-73601CRITICALFlowise before 3.1.3 Remote Code Execution via Custom MCPEPSS 0.9%CVE-2026-70470CRITICALFlowise: Pyodide validator Unicode homoglyph bypass leads to RCEEPSS 0.9%CVE-2026-73602CRITICALFlowise before 3.1.3 Sandbox Escape to RCEEPSS 0.8%CVE-2026-70477CRITICALFlowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-91932CRITICALFlowise before 3.1.4 Remote Code Execution via cwd ParameterEPSS 0.8%CVE-2026-69256CRITICALFlowise: Remote Code Execution Vulnerability in CSVAgentEPSS 0.8%CVE-2026-69259CRITICALFlowise RCE via SQLite Record Manager NodeEPSS 0.7%CVE-2026-71962HIGHFlowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/downloadEPSS 0.7%CVE-2026-91934HIGHFlowise before 3.1.4 Remote Code Execution via SQL Database ChainEPSS 0.7%CVE-2026-73486CRITICALFlowise before 3.1.3 Code Injection via CSV Agent customReadCSVEPSS 0.7%CVE-2026-69254CRITICALFlowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions OverrideEPSS 0.7%CVE-2026-73485CRITICALFlowise before 3.1.3 Remote Code Execution via Airtable AgentEPSS 0.6%CVE-2026-69253CRITICALFlowise Sandbox Escape to RCEEPSS 0.6%