Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

Fix availableCritical · CVSS 9EPSS 0.96%

Published Oct 7, 2026 · updated Oct 7, 2026

What to do

  1. Upgrade to a fixed version: flowise 3.1.3, flowise-components 3.1.3.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmflowise

Vulnerable versions
<= 3.1.2
Fixed in
3.1.3

Check your project: npm ls flowise --all

Is flowise@3.1.3 safe to install? See the upgrade verdict →

npmflowise-components

Vulnerable versions
<= 3.1.2
Fixed in
3.1.3

Check your project: npm ls flowise-components --all

Is flowise-components@3.1.3 safe to install? See the upgrade verdict →

Sources

CWE-94 Improper Control of Generation of Code ('Code Injection')

← All critical vulnerabilities