https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 12:57:46 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292986 EUVD-2026-292986 https://cve.radiocsirt.org/vuln/euvd-2026-292986 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41270 <p>Flowise is a drag &amp; drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTP_DENY_LIST for axios and node-fetch libraries, the built-in Node.js http, https, and net modules are allowed in the NodeVM sandbox without equivalent protection. This allows authenticated users to bypass SSRF controls and access internal network resources (e.g., cloud provider metadata services) This vulnerability is fixed in 3.1.0.</p> <p>Flowise is a drag &amp; drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTP_DENY_LIST for axios and node-fetch libraries, the built-in Node.js http, https, and net modules are allowed in the NodeVM sandbox without equivalent protection. This allows authenticated users to bypass SSRF controls and access internal network resources (e.g., cloud provider metadata services) This vulnerability is fixed in 3.1.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41270 https://cve.radiocsirt.org/vuln/ghsa-xhmj-rg95-44hv <p><strong>Affected:</strong> npm: flowise, npm: flowise-components</p> <p>### Summary A Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTP_DENY_LIST for axios and node-fetch libraries, the built-in Node.js `http`, `https`, and `net` modules are allowed in the NodeVM sandbox without equivalent protection. This allows authenticated users to bypass SSRF controls and access internal network resources (e.g., cloud provider metadata services)</p> <p>### Details The vulnerability exists in the sandbox configuration within `packages/components/src/utils.ts`</p> <p>**Vulnerable Code - Allowed Built-in Modules (Line 56):** ```typescript export const defaultAllowBuiltInDep = [ &#39;assert&#39;, &#39;buffer&#39;, &#39;crypto&#39;, &#39;events&#39;, &#39;http&#39;, &#39;https&#39;, &#39;net&#39;, &#39;path&#39;, &#39;querystring&#39;, &#39;timers&#39;, &#39;url&#39;, &#39;zlib&#39;, &#39;os&#39;, &#39;stream&#39;, &#39;http2&#39;, &#39;punycode&#39;, &#39;perf_hooks&#39;, &#39;util&#39;, &#39;tls&#39;, &#39;string_decoder&#39;, &#39;dns&#39;, &#39;dgram&#39; ] ```</p> <p>**SSRF Protection Implementation (Lines 254-261):** ```typescript // Only axios and node-fetch are wrapped with SSRF protection secureWrappers[&#39;axios&#39;] = secureAxiosWrapper secureWrappers[&#39;node-fetch&#39;] = secureNodeFetch</p> <p>const defaultNodeVMOptions: any = { // ... require: { builtin: builtinDeps, // &lt;-- http, https, net allowed here mock: secureWrappers // &lt;-- Only mocks axios, node-fetch }, // ... } ```</p> <p>**Root Cause:** - The `secureWrappers` object only contains mocked versions of `axios` and `node-fetch` that enforce `HT…</p> <p><strong>Affected:</strong> npm: flowise, npm: flowise-components</p> <p>### Summary A Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTP_DENY_LIST for axios and node-fetch libraries, the built-in Node.js `http`, `https`, and `net` modules are allowed in the NodeVM sandbox without equivalent protection. This allows authenticated users to bypass SSRF controls and access internal network resources (e.g., cloud provider metadata services)</p> <p>### Details The vulnerability exists in the sandbox configuration within `packages/components/src/utils.ts`</p> <p>**Vulnerable Code - Allowed Built-in Modules (Line 56):** ```typescript export const defaultAllowBuiltInDep = [ &#39;assert&#39;, &#39;buffer&#39;, &#39;crypto&#39;, &#39;events&#39;, &#39;http&#39;, &#39;https&#39;, &#39;net&#39;, &#39;path&#39;, &#39;querystring&#39;, &#39;timers&#39;, &#39;url&#39;, &#39;zlib&#39;, &#39;os&#39;, &#39;stream&#39;, &#39;http2&#39;, &#39;punycode&#39;, &#39;perf_hooks&#39;, &#39;util&#39;, &#39;tls&#39;, &#39;string_decoder&#39;, &#39;dns&#39;, &#39;dgram&#39; ] ```</p> <p>**SSRF Protection Implementation (Lines 254-261):** ```typescript // Only axios and node-fetch are wrapped with SSRF protection secureWrappers[&#39;axios&#39;] = secureAxiosWrapper secureWrappers[&#39;node-fetch&#39;] = secureNodeFetch</p> <p>const defaultNodeVMOptions: any = { // ... require: { builtin: builtinDeps, // &lt;-- http, https, net allowed here mock: secureWrappers // &lt;-- Only mocks axios, node-fetch }, // ... } ```</p> <p>**Root Cause:** - The `secureWrappers` object only contains mocked versions of `axios` and `node-fetch` that enforce `HT…</p> https://cve.radiocsirt.org/vuln/ghsa-xhmj-rg95-44hv https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1145 <p>Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um Dateien zu manipulieren.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um Dateien zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1145