The Spread Operator Is an Allowlist With Nothing In It: CVE-2026-69258 in Flowise
Three characters of JavaScript grant an unauthenticated caller write access to every field in an object, including the ones you add six months later. Here is the primitive, the sink, the CWE argument, and the grep that finds it in your own codebase.
I do not spend much time looking for novel bug classes. Most of what I find is an old class that arrived somewhere new, wearing different clothes, in a codebase where nobody expected it.
...userInput is one of those. Three characters. It reads like syntax rather than a decision. And in every TypeScript backend I have audited this year, it is the single most reliable place to find mass assignment.
CVE-2026-69258 is a clean specimen. Flowise, one of the most widely self-hosted visual builders for LLM applications, spread an attacker-controlled object into the execution context of any public chatflow. Two sites. Both unauthenticated. Both in files that...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
