# flowise-components (npm) vulnerabilities Source: https://junglewise.ai/threats/technologies/flowise-components Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/flowise-components.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 33 vulnerabilities in flowise-components (npm): 0 in the last 7 days and 1 in the last 90 days, 19 of them critical and 0 exploited in the wild. The most recent, CVE-2026-91931, was published on 15 September 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 1 - All time: 33 (19 critical, 0 exploited in the wild) ## About flowise-components (npm) npm package providing reusable components for the Flowise visual programming platform. ## Latest flowise-components (npm) vulnerabilities - [CVE-2026-91931: Flowise Custom MCP remote code execution via npx](https://junglewise.ai/threats/cve-2026-91931-flowise-custom-mcp-remote-code-execution-via-npx) (high, CVSS 8.5, published 15 Sep 2026) - [Duplicate Advisory: Flowise contains an unauthenticated sandbox escape](https://junglewise.ai/threats/duplicate-advisory-flowise-contains-an-unauthenticated-sandbox-escape-8959e167) (high, CVSS 8.8, published 13 Aug 2026) - [CVE-2026-73487: Flowise CSV and Airtable Agent prompt injection to RCE](https://junglewise.ai/threats/cve-2026-73487-flowise-csv-and-airtable-agent-prompt-injection-to-rce) (critical, CVSS 9.8, published 13 Aug 2026) - [CVE-2026-73483: Flowise sandbox escape via puppeteer in NodeVM](https://junglewise.ai/threats/cve-2026-73483-flowise-sandbox-escape-via-puppeteer-in-nodevm) (critical, CVSS 8.8, published 13 Aug 2026) - [CVE-2026-70477: Flowise RCE via CSV Agent Prompt Injection](https://junglewise.ai/threats/cve-2026-70477-flowise-rce-via-csv-agent-prompt-injection) (critical, CVSS 9.8, published 4 Aug 2026) - [CVE-2026-70470: Flowise Pyodide validator Unicode homoglyph bypass in CSV and Airtable Agents](https://junglewise.ai/threats/cve-2026-70470-flowise-pyodide-validator-unicode-homoglyph-bypass-in-csv-and) (critical, CVSS 9.8, published 4 Aug 2026) - [CVE-2026-69264: Flowise Flowise RCE via Python injection in CSVAgent](https://junglewise.ai/threats/cve-2026-69264-flowise-flowise-rce-via-python-injection-in-csvagent) (critical, CVSS 9.8, published 4 Aug 2026) - [Flowise arbitrary file write in S3 Directory document loader](https://junglewise.ai/threats/flowise-arbitrary-file-write-in-s3-directory-document-loader-ddfb933e) (medium, CVSS 4, published 4 Aug 2026) - [CVE-2026-69263: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation…](https://junglewise.ai/threats/cve-2026-69263-flowise-rce-via-mcp-environment-variable-blocklist-bypass) (critical, CVSS 9.8, published 4 Aug 2026) - [CVE-2026-69259: Flowise Remote Code Execution in SQLite Record Manager node](https://junglewise.ai/threats/cve-2026-69259-flowise-remote-code-execution-in-sqlite-record-manager-node) (critical, CVSS 8.8, published 4 Aug 2026) - [CVE-2026-69256: Flowise CSVAgent remote code execution via pandas read_pickle](https://junglewise.ai/threats/cve-2026-69256-flowise-csvagent-remote-code-execution-via-pandas-read-pickle) (critical, CVSS 8.8, published 4 Aug 2026) - [CVE-2026-69255: Flowise CSV Agent remote code execution via Pyodide code injection](https://junglewise.ai/threats/cve-2026-69255-flowise-csv-agent-remote-code-execution-via-pyodide-code) (critical, CVSS 8.8, published 4 Aug 2026) - [CVE-2026-69254: Flowise NodeVM sandbox escape in executeJavaScriptCode](https://junglewise.ai/threats/cve-2026-69254-flowise-nodevm-sandbox-escape-in-executejavascriptcode) (critical, CVSS 8.8, published 4 Aug 2026) - [CVE-2026-69253: Flowise JavaScript sandbox escape to RCE](https://junglewise.ai/threats/cve-2026-69253-flowise-javascript-sandbox-escape-to-rce) (high, CVSS 8.8, published 4 Aug 2026) - [CVE-2026-69251: Flowise RCE via TypeORM DataSource configuration](https://junglewise.ai/threats/cve-2026-69251-flowise-rce-via-typeorm-datasource-configuration) (critical, CVSS 8.8, published 4 Aug 2026) - [CVE-2026-56273: Flowise path traversal in Faiss and SimpleStore vector stores](https://junglewise.ai/threats/cve-2026-56273-flowise-path-traversal-in-faiss-and-simplestore-vector-stores) (medium, CVSS 6.5, published 8 Jul 2026) - [CVE-2026-56275: Flowise SSRF in Execute Flow node](https://junglewise.ai/threats/cve-2026-56275-flowise-ssrf-in-execute-flow-node) (high, CVSS 7.1, published 23 Jun 2026) - [CVE-2026-56274: Flowise OS command injection in Custom MCP Server feature](https://junglewise.ai/threats/cve-2026-56274-flowise-os-command-injection-in-custom-mcp-server-feature) (critical, CVSS 9.9, published 23 Jun 2026) - [CVE-2026-43995: Flowise SSRF protection bypass in multiple tool components](https://junglewise.ai/threats/cve-2026-43995-flowise-ssrf-protection-bypass-in-multiple-tool-components) (critical, CVSS 9.8, published 11 May 2026) - [CVE-2026-41274: Flowise: Cypher Injection in GraphCypherQAChain](https://junglewise.ai/threats/cve-2026-41274-flowise-cypher-injection-in-graphcypherqachain) (critical, CVSS 9.8, published 23 Apr 2026) - [CVE-2026-41272: Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)](https://junglewise.ai/threats/cve-2026-41272-flowise-ssrf-protection-bypass-toctou-default-insecure) (high, CVSS 7.1, published 23 Apr 2026) - [CVE-2026-41271: Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains](https://junglewise.ai/threats/cve-2026-41271-flowise-apichain-prompt-injection-ssrf-in-get-post-api-chains) (high, CVSS 8.3, published 23 Apr 2026) - [CVE-2026-41270: Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox](https://junglewise.ai/threats/cve-2026-41270-flowise-ssrf-protection-bypass-via-unprotected-built-in-http) (high, CVSS 7.1, published 23 Apr 2026) - [CVE-2026-41268: Flowise: Parameter Override Bypass Remote Command Execution](https://junglewise.ai/threats/cve-2026-41268-flowise-parameter-override-bypass-remote-command-execution) (critical, CVSS 9.8, published 23 Apr 2026) - [CVE-2026-41265: Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2026-41265-flowise-airtable-agent-code-injection-remote-code-execution) (critical, CVSS 9.8, published 23 Apr 2026) ## Most severe flowise-components (npm) vulnerabilities - [CVE-2025-61913: Flowise WriteFileTool arbitrary file write vulnerability](https://junglewise.ai/threats/cve-2025-61913-flowise-writefiletool-arbitrary-file-write-vulnerability) (critical, CVSS 9.9, published 8 Oct 2025) - [CVE-2026-40933: Flowise Flowise authenticated RCE in MCP Adapters](https://junglewise.ai/threats/cve-2026-40933-flowise-flowise-authenticated-rce-in-mcp-adapters) (critical, CVSS 9.9, published 21 Apr 2026) - [CVE-2026-56274: Flowise OS command injection in Custom MCP Server feature](https://junglewise.ai/threats/cve-2026-56274-flowise-os-command-injection-in-custom-mcp-server-feature) (critical, CVSS 9.9, published 23 Jun 2026) - [CVE-2026-41268: Flowise: Parameter Override Bypass Remote Command Execution](https://junglewise.ai/threats/cve-2026-41268-flowise-parameter-override-bypass-remote-command-execution) (critical, CVSS 9.8, published 23 Apr 2026) - [CVE-2026-41264: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2026-41264-flowise-csv-agent-prompt-injection-remote-code-execution) (critical, CVSS 9.8, published 23 Apr 2026) - [CVE-2026-69264: Flowise Flowise RCE via Python injection in CSVAgent](https://junglewise.ai/threats/cve-2026-69264-flowise-flowise-rce-via-python-injection-in-csvagent) (critical, CVSS 9.8, published 4 Aug 2026) - [CVE-2026-70470: Flowise Pyodide validator Unicode homoglyph bypass in CSV and Airtable Agents](https://junglewise.ai/threats/cve-2026-70470-flowise-pyodide-validator-unicode-homoglyph-bypass-in-csv-and) (critical, CVSS 9.8, published 4 Aug 2026) - [CVE-2026-70477: Flowise RCE via CSV Agent Prompt Injection](https://junglewise.ai/threats/cve-2026-70477-flowise-rce-via-csv-agent-prompt-injection) (critical, CVSS 9.8, published 4 Aug 2026) - [CVE-2026-73487: Flowise CSV and Airtable Agent prompt injection to RCE](https://junglewise.ai/threats/cve-2026-73487-flowise-csv-and-airtable-agent-prompt-injection-to-rce) (critical, CVSS 9.8, published 13 Aug 2026) - [CVE-2026-69263: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation…](https://junglewise.ai/threats/cve-2026-69263-flowise-rce-via-mcp-environment-variable-blocklist-bypass) (critical, CVSS 9.8, published 4 Aug 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 1 vulnerability in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other npm technologies - [openclaw (npm)](https://junglewise.ai/threats/technologies/npm-openclaw): 214 vulnerabilities - [flowise (npm)](https://junglewise.ai/threats/technologies/flowise): 133 vulnerabilities - [parse-server (npm)](https://junglewise.ai/threats/technologies/parse-server): 117 vulnerabilities - [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2): 111 vulnerabilities - [electron (npm)](https://junglewise.ai/threats/technologies/electron): 77 vulnerabilities - [ghost (npm)](https://junglewise.ai/threats/technologies/ghost): 74 vulnerabilities - [n8n (npm)](https://junglewise.ai/threats/technologies/npm-n8n): 64 vulnerabilities - [hono (npm)](https://junglewise.ai/threats/technologies/hono): 62 vulnerabilities - [directus (npm)](https://junglewise.ai/threats/technologies/directus): 61 vulnerabilities - [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb): 54 vulnerabilities - [undici (npm)](https://junglewise.ai/threats/technologies/undici): 53 vulnerabilities - [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server): 42 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "flowise-components (npm) vulnerabilities", https://junglewise.ai/threats/technologies/flowise-components, 13 November 2026.