AIHacker Noonabout 4 hours ago
Spread Operator Flaw Grants Full Write Access in Flowise
12 min read
CVE-2026-69258 in Flowise lets unauthenticated callers write to every object field via a three-character JavaScript spread operator. The flaw acts as an allowlist with nothing in it, affecting TypeScript backends. The primitive, sink, and CWE argument are detailed, with a grep to find it.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
