npm

flowise-components

29 Total advisories

29 Vulnerabilities

0 Malware

Dependency scanning

Check whether flowise-components is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

flowise-components

Vulnerabilities

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Flowise: Remote Code Execution Vulnerability in CSVAgent

Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys

Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

Flowise RCE via SQLite Record Manager Node

Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

Flowise Sandbox Escape to RCE

Flowise RCE via TypeORM DataSource

Flowise: Path Traversal in Vector Store basePath

Flowise has an MCP Security Bypass that Enables RCE

Flowise Execute Flow function has an SSRF vulnerability

Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)

Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox

Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability

Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.

Flowise: Parameter Override Bypass Remote Command Execution

Flowise: Code Injection in CSVAgent leads to Authenticated RCE

Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)

Flowise: Cypher Injection in GraphCypherQAChain

Flowise: Authenticated RCE Via MCP Adapters

Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access

Flowise is vulnerable to arbitrary file write through its WriteFileTool

Flowise is vulnerable to arbitrary file exposure through its ReadFileTool

Flowise Vulnerable to SQL Injection via `tableName` Parameter

Browse more npm advisories

Start Securing