Flowise version 3.1.2 contains a vulnerability that allows remote attackers to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint. This issue enables unauthorized code execution on the affected system.
Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a valid chatflow UUID, incurring costs on the chatflow owner's account.
Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.read_json() to exfiltrate datasets, perform SSRF against internal services, or achieve code execution through the unauthenticated prediction API.
Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to execute code in the unsandboxed pyodide environment with full system access.
Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the Airtable Agent node to inject malicious Python code that executes in an unsandboxed pyodide environment with full access to the host operating system.
Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem.
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.
Flowise versions prior to 3.1.3 contain a vulnerability where the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is accessible without authentication. This endpoint decrypts stored OAuth credentials and returns refreshed access tokens, exposing sensitive information to unauthorized actors. An attacker with knowledge of a credential ID can obtain access tokens to connected services and potentially exhaust refresh-token quotas. The issue is fixed in version 3.1.3.
CVE-2026-70477 is a critical code injection vulnerability in FlowiseAI Flowise versions prior to 3.1.3. The flaw allows an attacker to send a crafted prompt to a chatflow using a CSV Agent node, causing the large language model to generate and execute malicious Python code in an unsandboxed Pyodide environment. This occurs because untrusted data is used to build the LLM prompt and the resulting code validation is bypassed. The vulnerability is fixed in version 3.1.3.
CVE-2026-70476 is an improper access control vulnerability in FlowiseAI Flowise versions prior to 3.1.3. It allows an authenticated attacker to manipulate Stripe subscription operations for other tenants by exploiting insufficient verification of subscription identifiers. This can lead to unauthorized changes in subscription plans or seat quantities, causing financial impact and service disruption. The issue is fixed in version 3.1.3.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.
FlowiseAI Flowise versions prior to 3.1.3 contain an incorrect authorization vulnerability in their OAuth2 credential endpoints. The endpoints authorize, callback, and refresh query credentials by ID without filtering by workspace ID, and some handlers are accessible without authentication. This flaw allows authenticated users to initiate OAuth2 flows using credentials from other workspaces and unauthenticated attackers to forge OAuth2 callbacks or refresh tokens for any credential. The issue is resolved in version 3.1.3.
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB and includes sensitive configuration data, including Vector Store settings such as Qdrant Server URL and collection name. The observed behavior indicates missing or insufficient authorization checks, workspace/project/tenant isolation, and pagination or limits, exposing integration parameters and infrastructure details that may enable further targeted attacks. This issue is fixed in version 3.1.3.
CVE-2026-70472 is an improper authorization vulnerability in FlowiseAI Flowise versions prior to 3.1.3. The issue allows an attacker to use a client-controlled credential parameter to access credentials belonging to other workspaces without proper authorization checks. This can lead to unauthorized use of OpenAI API keys, modification or deletion of victim vector stores and files, and potential billing impact on the victim's OpenAI account. The vulnerability violates multi-tenant boundaries and is fixed in version 3.1.3.
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetched at packages/components/src/utils.ts and runtime variables are resolved from server environment variables, while the official variables route enforces variables:view. A user or API key that is denied variables:view can call /api/v1/node-custom-function and receive $vars pre-populated with all variables for the workspace, including Variable.name to Variable.value static variables and Variable.name to process.env[Variable.name] runtime variables. This can expose secrets such as database passwords, JWT secrets, SMTP passwords, and cloud keys, depending on the workspace Variables configuration. This issue is fixed in version 3.1.3.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, and __b𝐮iltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3.
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import, the attacker can break out of the Python string literal, hand a JavaScript string to js.eval, dynamically import Node built-in modules such as fs and child_process, and execute arbitrary file I/O or OS commands as the Flowise process. The two validator paths around this code, validatePythonCodeForDataFrame and validateCustomReadCSVFunction, are never applied to the bootstrap template. A workspace user with chatflows:create or agentflows/chatflows update permission can plant a CSV Agent node with a crafted csvFile; once the chatflow is exposed via POST /api/v1/prediction/:id, any unauthenticated request triggers host remote code execution. This issue is fixed in version 3.1.3.
Flowise versions prior to 3.1.3 have an incomplete mitigation for a security issue where certain environment variables were not blocked, allowing unintended automatic package installation via npx when launching a Custom MCP server. This vulnerability is identified as CVE-2026-69263 and is fixed in version 3.1.3.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, `DELETE /api/v1/chatflows/:id` authorized requests with checkAnyPermission('chatflows:delete,agentflows:delete'), so possession of either permission was sufficient to reach the delete path. The delete logic then resolved the target record only by id and workspaceId and did not validate the target resource type, allowing a caller with only agentflows:delete to delete a CHATFLOW and a caller with only chatflows:delete to delete an AGENTFLOW in the same workspace. This issue is fixed in version 3.1.3.
CVE-2026-69259 is a critical code injection vulnerability in FlowiseAI's Flowise prior to version 3.1.3. The SQLite Record Manager node improperly handles user-controlled configuration, allowing an authenticated attacker to overwrite the SQLite database path. Exploiting this, an attacker running the published Docker image as root could write malicious SQLite databases to sensitive system paths such as /etc/chromium/exploit.conf. By controlling database content, the attacker could inject shell syntax that executes when Puppeteer launches Chromium and sources configuration files. This vulnerability is fixed in Flowise version 3.1.3.