Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

Fix availableCritical · CVSS 9.4EPSS 0.62%

Published Oct 7, 2026 · updated Oct 7, 2026

What to do

  1. Upgrade to a fixed version: flowise 3.1.3, flowise-components 3.1.3.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmflowise

Vulnerable versions
<= 3.1.2
Fixed in
3.1.3

Check your project: npm ls flowise --all

Is flowise@3.1.3 safe to install? See the upgrade verdict →

npmflowise-components

Vulnerable versions
<= 3.1.2
Fixed in
3.1.3

Check your project: npm ls flowise-components --all

Is flowise-components@3.1.3 safe to install? See the upgrade verdict →

Sources

← All critical vulnerabilities