Threats tagged 'ghsa-3769-jgqc-cxm7'

CVE-2026-69254 is a critical code injection vulnerability in FlowiseAI's Flowise prior to version 3.1.3. It allows an authenticated attacker with limited privileges to execute arbitrary system commands as root by exploiting improper control over JavaScript code execution options. The flaw arises from the executeJavaScriptCode() function merging caller-provided NodeVM options over default security settings, enabling escalation to full system command execution. This issue is fixed in Flowise version 3.1.3.