https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T13:00:51.641998+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-310029 EUVD-2026-310029 2026-10-04T13:00:51.644437+00:00 EUVD-2026-310029 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43995 fkie_cve-2026-43995 2026-10-04T13:00:51.644468+00:00

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.

 https://cve.radiocsirt.org/vuln/ghsa-qqvm-66q4-vf5c GHSA-qqvm-66q4-vf5c — Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) 2026-10-04T13:00:51.644501+00:00

Affected: npm: flowise, npm: flowise-components

### Summary

Flowise introduced SSRF protections through a centralized HTTP security wrapper (`httpSecurity.ts`) that implements deny-list validation and IP pinning logic.

However, multiple tool implementations directly import and invoke raw HTTP clients (`node-fetch`, `axios`Instead of using the secured wrapper.

Because enforcement is neither mandatory nor centralized, these tools bypass SSRF mitigation entirely, restoring full SSRF capability even after the patch.

This issue is distinct from specification trust issues and represents incomplete mitigation of previously addressed SSRF vulnerabilities.

### Details **Intended Security Model:**

All outbound HTTP requests should pass through the centralized validation layer implemented in:

``` packages/components/src/httpSecurity.ts ```

This layer performs:

- `HTTP_DENY_LIST` enforcement - IP resolution validation - IP pinning - Loopback blocking

**Observed Implementation Gap:**

Multiple tools bypass this layer and import HTTP libraries directly.

Examples include:

- `packages/components/nodes/tools/OpenAPIToolkit/OpenAPIToolkit.ts` - `packages/components/nodes/tools/WebScraperTool/WebScraperTool.ts` - `packages/components/nodes/tools/MCP/core.ts` - `packages/components/nodes/tools/Arxiv/core.ts`

These files directly execute:

``` importfetchfrom'node-fetch' ```

or invoke `axios` without passing through the centralized validation wrapper.

Because there is no global interceptor or enforcement mechanism, outbound req…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1145 WID-SEC-W-2026-1145 — Flowise: Mehrere Schwachstellen 2026-10-04T13:00:51.644561+00:00

Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um Dateien zu manipulieren.