CVE Watch8 de out. de 2026

CVE-2025-34267

Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability

CVSS

9.9

Crítica

EPSS

6.9%

p94

KEV

—

Exploit Today

0-100

Publicado: 14 de out. de 2025 · Última mod.: 8 de out. de 2026 · CWE-77

EPSS · 30d

6.6%EPSS · 30 dias6.9%

2026-10-172026-11-13

Descrição técnica

Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execution environment. An authenticated attacker able to create or run a tool that leverages Puppeteer/Playwright can specify attacker-controlled browser binary paths and parameters. When the tool executes, the attacker-controlled executable/parameters are run on the host and circumvent the intended nodevm sandbox restrictions, resulting in execution of arbitrary code in the context of the host. This vulnerability was incorrectly assigned as a duplicate CVE-2025-26319 by the developers and should be considered distinct from that identifier.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1261677.2 ALT

74.9%

——22A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.1d CVE-2026-960537.8 ALT

54.7%

——16Improper neutralization of special elements used in a command ('command injection') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.4d CVE-2026-839535.5 MÉD

58.1%

——17Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an authorized attacker to disclose information locally.4d CVE-2026-1233878.0 ALT

57.4%

——17Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privileges over a network.4d CVE-2026-1216628.6 ALT

45.2%

——14Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.4d CVE-2026-1199898.2 ALT

48.9%

——15Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.5d