{"id":"EUVD-2026-52701","revision":"ccd6dcdfe8e647f9bf88bc5b04887f6a","records":[{"revision":"ccd6dcdfe8e647f9bf88bc5b04887f6a","observedAt":"2026-11-15T17:45:21.061+00:00","statement":{"source":"euvd","id":"EUVD-2026-52701","aliases":["CVE-2026-69251","GHSA-g32j-mmxr-gfq5"],"title":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig in…","description":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts, packages/components/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts, packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts, packages/components/nodes/memory/AgentMemory/MySQLAgentMemory/MySQLAgentMemory.ts, and packages/components/nodes/memory/AgentMemory/AgentMemory.ts. TypeORM DataSource options such as entities, subscribers, and migrations can load local JavaScript files, allowing an authenticated user to execute arbitrary code on the server by uploading a JavaScript payload and referencing it from additionalConfig.entities. This issue is fixed in version 3.1.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9,"severity":null}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-g32j-mmxr-gfq5"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-52701","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 4, 2026, 2:27:55 PM","dateUpdated":"Aug 4, 2026, 3:35:08 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-2589","title":"Flowise: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-69250","CVE-2026-69251","CVE-2026-69252","CVE-2026-69253","CVE-2026-69254","CVE-2026-69255","CVE-2026-69256","CVE-2026-69257","CVE-2026-69258","CVE-2026-69259","CVE-2026-69262","CVE-2026-69263","CVE-2026-69264","CVE-2026-70470","CVE-2026-70471","CVE-2026-70472","CVE-2026-70473","CVE-2026-70474","CVE-2026-70475","CVE-2026-70476","CVE-2026-70477","CVE-2026-70478","CVE-2026-73483","CVE-2026-73484","CVE-2026-73485","CVE-2026-73486","CVE-2026-73487","CVE-2026-73601","CVE-2026-73602"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-52701","identifiers":["EUVD-2026-52701","CVE-2026-69251","GHSA-g32j-mmxr-gfq5"]},"retained":false,"historicalAffected":[]}],"coverage":[]}