Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-34232 State: PUBLISHED Published: 2025-09-29T20:34:00.950Z Last Updated: 2025-11-17T23:56:37.646Z Vendors: Vasion Products: Print Virtual Appliance Host, Print Application Problem Types: CWE-306, CWE-918 Description: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_release/lexmark/dellCheck.php script that can be exploited by an unauthenticated user. When a printer is registered, the software stores the printer’s host name in the variable $printer_vo->str_host_address. The
a printer is registered, the software stores the printer’s host name in the variable $printer_vo->str_host_address. The code later builds a URL like 'http://<host‑address>:80/DevMgmt/DiscoveryTree.xml' and sends the request with curl. No validation, whitelist, or private‑network filtering is performed before the request is made. Because the request is blind, an attacker cannot see the data directly, but can still: probe internal services, trigger internal actions, or gather other intelligence. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pierrekim.github
when the patch was introduced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-ssrf-08 - https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm - https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm - https://www.vulncheck.com/advisories/vasion-print-printerlogic-blind-ssrf-via-lexmark-dellcheck-php-script
CVE ID: CVE-2025-34233 State: PUBLISHED Published: 2025-09-29T20:38:49.403Z Last Updated: 2025-11-17T23:56:37.811Z Vendors: Vasion Products: Print Virtual Appliance Host, Print Application Problem Types: CWE‑693 Protection Mechanism Failure, CWE-918 Description: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a protection mechanism failure vulnerability within the file_get_contents() function. When an administrator configures a printer’s hostname (or similar callback field), the value is passed unchecked to PHP’s file_get_contents()/cURL functions, which follow redirects and impose
ck field), the value is passed unchecked to PHP’s file_get_contents()/cURL functions, which follow redirects and impose no allow‑list, scheme, or IP‑range restrictions. An admin‑level attacker can therefore point the hostname to a malicious web server that issues a 301 redirect to internal endpoints such as the AWS EC2 metadata service. The server follows the redirect, retrieves the metadata, and returns or stores the credentials, enabling the attacker to steal cloud IAM keys, enumerate internal services, and pivot further into the SaaS infrastructure. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced. Additional Analyst Notes: - CI
s been confirmed to be remediated, but it is unclear as to when the patch was introduced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-insecure-use-file_get_contents - https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm - https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm - https://www.vulncheck.com/advisories/vasion-print-printerlogic-insecure-use-of-file-get-contents-function
CVE ID: CVE-2025-34234 State: PUBLISHED Published: 2025-09-29T20:34:45.051Z Last Updated: 2025-11-17T23:56:37.989Z Vendors: Vasion Products: Print Virtual Appliance Host, Print Application Problem Types: CWE-321 Description: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain two hardcoded private keys that are shipped in the application containers (printerlogic/pi, printerlogic/printer-admin-api, and printercloud/pi). The keys are stored in clear text under /var/www/app/config/ as keyfile.ppk.dev and keyfile.saasid.ppk.dev. The application uses these keys as the symmetric secret for AE
pp/config/ as keyfile.ppk.dev and keyfile.saasid.ppk.dev. The application uses these keys as the symmetric secret for AES‑256‑CBC encryption/decryption of the “SaaS Id” (external identifier) through the getEncryptedExternalId() / getDecryptedExternalId() methods. Because the secret is embedded in the deployed image, any attacker who can obtain a copy of the Docker image, read the configuration files, or otherwise enumerate the filesystem can recover the encryption key. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pierrekim.github.io/blog/2025-04-08-vasion
ced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-hardcoded-key - https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm - https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm - https://www.vulncheck.com/advisories/vasion-print-printerlogic-hardcoded-encryption-private-keys
CVE ID: CVE-2025-34235 State: PUBLISHED Published: 2025-09-29T20:44:01.002Z Last Updated: 2025-11-17T23:56:38.182Z Vendors: Vasion Products: Print Virtual Appliance Host, Print Application Problem Types: CWE-295 Description: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (Windows client deployments) contain a registry key that can be enabled by administrators, causing the client to skip SSL/TLS certificate validation. An attacker who can intercept HTTPS traffic can then inject malicious driver DLLs, resulting in remote code execution with SYSTEM privileges; a local attacker can achieve local privilege escalatio
DLLs, resulting in remote code execution with SYSTEM privileges; a local attacker can achieve local privilege escalation via a junction‑point DLL injection. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#win-lpe-04 - https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm - https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm - https://www.vulncheck.com/advisories/vasion-print-printerlogic-weak-ssl-tls-certificate-validation-rce
CVE ID: CVE-2025-34236 State: PUBLISHED Published: 2025-11-06T19:39:40.112Z Last Updated: 2025-11-17T19:38:09.659Z Vendors: Advantech Products: WebAccess/VPN Problem Types: CWE-79 Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via NetworksController.addNetworkAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisorie
antech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-vpn-stored-xss-via-networkcontroller - https://icr.advantech.com/download/software
CVE ID: CVE-2025-34237 State: PUBLISHED Published: 2025-11-06T19:40:50.496Z Last Updated: 2025-11-17T19:38:09.854Z Vendors: Advantech Products: WebAccess/VPN Problem Types: CWE-79 Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www
ences: - https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-vpn-stored-xss-via-standalonevpnclientscontroller - https://icr.advantech.com/download/software
CVE ID: CVE-2025-34238 State: PUBLISHED Published: 2025-11-06T19:43:35.153Z Last Updated: 2025-11-17T19:38:10.021Z Vendors: Advantech Products: WebAccess/VPN Problem Types: CWE-22 Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web user (www-data) can access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vul
s: - https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-vpn-path-traversal-via-ajaxstandalonevpnclientscontroller - https://icr.advantech.com/download/software
CVE ID: CVE-2025-34239 State: PUBLISHED Published: 2025-11-06T19:44:18.796Z Last Updated: 2025-11-17T19:38:10.205Z Vendors: Advantech Products: WebAccess/VPN Problem Types: CWE-78 Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute arbitrary commands as the web server user (www-data) by supplying a crafted uploaded filename. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-web
ort/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-vpn-command-injection-in-appmanagementcontroller - https://icr.advantech.com/download/software
CVE ID: CVE-2025-34240 State: PUBLISHED Published: 2025-11-06T19:45:02.692Z Last Updated: 2025-11-17T19:38:10.379Z Vendors: Advantech Products: WebAccess/VPN Problem Types: CWE-89 Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-v
er-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-appmanagementcontroller-appupgradeaction - https://icr.advantech.com/download/software
CVE ID: CVE-2025-34241 State: PUBLISHED Published: 2025-11-06T19:45:39.944Z Last Updated: 2025-11-17T19:38:10.537Z Vendors: Advantech Products: WebAccess/VPN Problem Types: CWE-89 Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-vpn-
models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-ajaxdevicecontroller-ajaxdeviceaction - https://icr.advantech.com/download/software
CVE ID: CVE-2025-34242 State: PUBLISHED Published: 2025-11-06T19:46:20.183Z Last Updated: 2025-11-17T19:38:10.701Z Vendors: Advantech Products: WebAccess/VPN Problem Types: CWE-89 Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-
s/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-ajaxnetworkcontroller - https://icr.advantech.com/download/software
CVE ID: CVE-2025-34243 State: PUBLISHED Published: 2025-11-06T19:47:04.733Z Last Updated: 2025-11-17T19:38:10.859Z Vendors: Advantech Products: WebAccess/VPN Problem Types: CWE-89 Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webac
t/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-ajaxfwrulescontroller-ajaxnetworkfwrulesaction - https://icr.advantech.com/download/software
CVE ID: CVE-2025-34244 State: PUBLISHED Published: 2025-11-06T19:47:41.796Z Last Updated: 2025-11-17T19:38:11.026Z Vendors: Advantech Products: WebAccess/VPN Problem Types: CWE-89 Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webacc
/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-ajaxfwruelscontroller-ajaxdevicefwrulesaction - https://icr.advantech.com/download/software
CVE ID: CVE-2025-34245 State: PUBLISHED Published: 2025-11-06T19:48:21.189Z Last Updated: 2025-11-17T19:38:11.183Z Vendors: Advantech Products: WebAccess/VPN Problem Types: CWE-89 Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webacc
/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-ajaxstandalonevpnclientscontroller - https://icr.advantech.com/download/software
CVE ID: CVE-2025-34246 State: PUBLISHED Published: 2025-11-06T19:49:01.611Z Last Updated: 2025-11-17T19:38:11.350Z Vendors: Advantech Products: WebAccess/VPN Problem Types: CWE-89 Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-vpn
-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-ajaxprevalidationcontroller - https://icr.advantech.com/download/software
CVE ID: CVE-2025-34247 State: PUBLISHED Published: 2025-11-06T19:49:37.330Z Last Updated: 2025-11-17T19:38:11.514Z Vendors: Advantech Products: WebAccess/VPN Problem Types: CWE-89 Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sq
dels/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf - https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-networkscontroller - https://icr.advantech.com/download/software
CVE ID: CVE-2025-34248 State: PUBLISHED Published: 2025-10-09T20:43:53.064Z Last Updated: 2025-10-14T12:48:28.137Z Vendors: D-Link Products: Nuclias Connect Problem Types: CWE-22 Description: D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability within /api/web/dnc/global/database/deleteBackup due to improper sanitization of the deleteBackupList parameter. This can allow an authenticated attacker to delete arbitrary files impacting the integrity and availability of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vulncheck.com/advisories/dlink-nuclias-connect-directory-traversal-to-arbitrary-file-deletion - http
nces: - https://www.vulncheck.com/advisories/dlink-nuclias-connect-directory-traversal-to-arbitrary-file-deletion - https://www.dlink.com/en/for-business/nuclias/nuclias-connect - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472
CVE ID: CVE-2025-34249 State: REJECTED Published: 2025-10-30T21:19:05.690Z Last Updated: 2025-11-07T18:19:39.010Z Description: No description available.
CVE ID: CVE-2025-34251 State: PUBLISHED Published: 2025-10-06T23:35:22.949Z Last Updated: 2025-10-24T23:03:14.853Z Vendors: Tesla Products: Telematics Control Unit (TCU) Problem Types: CWE-269, CWE-288 Description: Tesla Telematics Control Unit (TCU) firmware prior to v2025.14 contains an authentication bypass vulnerability. The TCU runs the Android Debug Bridge (adbd) as root and, despite a “lockdown” check that disables adb shell, still permits adb push/pull and adb forward. Because adbd is privileged and the device’s USB port is exposed externally, an attacker with physical access can write an arbitrary file to a writable location and then overwrite the kernel’s uevent_helper or /proc/sys
cal access can write an arbitrary file to a writable location and then overwrite the kernel’s uevent_helper or /proc/sys/kernel/hotplug entries via ADB, causing the script to be executed with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tesla.com/ - https://www.nccgroup.com/research-blog/technical-advisory-tesla-telematics-control-unit-adb-auth-bypass/ - https://www.vulncheck.com/advisories/tesla-tcu-auth-bypass
CVE ID: CVE-2025-34252 State: REJECTED Published: 2025-10-07T21:01:40.739Z Last Updated: 2025-10-09T16:58:14.274Z Description: No description available.
CVE ID: CVE-2025-34253 State: PUBLISHED Published: 2025-10-16T18:53:49.731Z Last Updated: 2025-10-17T14:28:40.054Z Vendors: D-Link Products: Nuclias Connect Problem Types: CWE-79 Description: D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry. NOTE: D-Link states that a fix is under development. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vulncheck.co
at a fix is under development. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vulncheck.com/advisories/dlink-nuclias-connect-stored-xss - https://www.dlink.com/en/for-business/nuclias/nuclias-connect - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472
CVE ID: CVE-2025-34254 State: PUBLISHED Published: 2025-10-16T18:52:08.435Z Last Updated: 2025-10-17T14:29:49.920Z Vendors: D-Link Products: Nuclias Connect Problem Types: CWE-204 Description: D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Login' endpoint returns distinct JSON responses depending on whether the supplied username is associated with an existing account. Because the responses differ in the `error.message`string value, an unauthenticated remote attacker can enumerate valid usernames/accounts on the server. NOTE: D-Link states that a fix is under development. Additional Analyst Notes: - CISA ADP Vul
es/accounts on the server. NOTE: D-Link states that a fix is under development. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vulncheck.com/advisories/dlink-nuclias-connect-login-account-enumeration - https://www.dlink.com/en/for-business/nuclias/nuclias-connect - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472
CVE ID: CVE-2025-34255 State: PUBLISHED Published: 2025-10-16T18:52:59.964Z Last Updated: 2025-10-17T14:29:17.095Z Vendors: D-Link Products: Nuclias Connect Problem Types: CWE-204 Description: D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development. Additional Analyst N
valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vulncheck.com/advisories/dlink-nuclias-connect-forgot-password-account-enumeration - https://www.dlink.com/en/for-business/nuclias/nuclias-connect - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472
CVE ID: CVE-2025-34267 State: PUBLISHED Published: 2025-10-14T19:31:50.914Z Last Updated: 2025-11-19T01:27:23.601Z Vendors: FlowiseAI Products: Flowise Problem Types: CWE-77 Description: Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execution environment. An authenticated attacker able to create or run a tool that leverages Puppeteer/Playwright can specify attacker-controlled browser binary paths and parameters. When the tool executes, the attacker-controlled executable/parameters are ru