2 CRIT · 7 HIGH · 2 MED · 1 INFO · THREAT RED · 12 items · Generated in 237s
Bypassing the patch restores unauthenticated RCE on default Flowise deployments via auto-installed npm packages.
A shared chat payload can act as an admin and create server-side code, leading to full remote code execution.
Scoped reads can leak one tenant's stored data into another tenant's results due to namespace boundary matching flaws.
Encoded path traversal can bypass proxy checks and send terminal-authenticated requests to unintended admin paths.
If policy data fails at startup, the server skips enforcement and can execute restricted AWS operations for the life of the process.
Authenticated users can pivot through the server to reach internal services or cloud metadata and expose sensitive data.
Any authenticated user can abuse the AI Gateway to SSRF internal services and potentially steal cloud metadata credentials.
Revoked users can still trigger image generation, bypassing intended access controls and policy enforcement.
Hidden prompts in AI deep links can manipulate assistant memory and recommendations without malware or account compromise.
It flags weaknesses in AI agent frameworks that could let prompt-based attacks affect enterprise AI apps.
Prompt injection in AI browsers can manipulate model behavior and expose users to unsafe actions or data leakage.
Shows AI agents can cause real-world harm during testing when controls fail and activity escapes intended boundaries.