Flowise before 3.1.4 Remote Code Execution via cwd Parameter | Advisories

Back Vulncheck

Flowise before 3.1.4 Remote Code Execution via cwd Parameter | Advisories

Vulncheck • September 15, 2026

Share: View original

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Remote Code Execution Vulnerabilities in Flowise and Spug Applications Two separate remote code execution vulnerabilities have been identified in Flowise and Spug applications. Flowise versions before 3.1.4 and Spug versions through 3.4.0 are affected by CWE-78, which allows OS command injection. Attackers can exploit these vulnerabilities to execute arbitrary commands on the host system. The vulnerabilities were disclosed in advisories published on September 15 and September 13, 2026, respectively. No specific CVEs were mentioned in the articles. Organizations using these applications are advised to prioritize patching. The scope of impact includes any systems running the affected versions of Flowise and Spug. Current status indicates that these vulnerabilities are known but exploitation details remain unclear. 2 sources 51

Extracted Entities

Attack Types (1)

Remote Code Execution

Platforms (1)