Executive brief
Flowise is a platform for building AI-powered workflows using language models. The overrideConfig feature allows configuration injection during workflow execution, but lacks proper security controls. An authenticated attacker can exploit this to execute arbitrary code, escape sandbox restrictions, cause service outages, or manipulate AI prompts to exfiltrate sensitive data from the server.
Technical details
Flowise's overrideConfig option (available in both API and web integration) allows developers to inject configuration into Chainflow execution with insufficient validation. The vulnerability stems from external control of system configuration settings (CWE-15) combined with use of the vm2 sandbox library, which has documented unfixable security flaws. An authenticated attacker with high privileges can inject malicious configuration to achieve: remote code execution within the sandbox with potential escape, server denial-of-service through crash attacks, server-side request forgery (SSRF), and prompt injection attacks to control LLM outputs and exfiltrate server variables and data. The attack is self-targeted (does not persist across users) but exposes the server and business to compromise. Patches are available in version 2.1.4 and later, which should disable overrideConfig by default and implement an explicit allowlist for permitted modifications.
Affected products
- FlowiseAI Flowise < 2.1.4
Timeline
- 2024-11-21: disclosed
- 2024-11-21: patched: Fixed in version 2.1.4