Executive brief
Flowise, an open-source platform for building AI agents and workflows, contains a vulnerability that allows authenticated users to execute arbitrary commands on the underlying server. By creating a custom tool that uses built-in browser automation modules, an attacker can bypass security restrictions to run malicious code. This could lead to a complete takeover of the server, theft of sensitive AI training data, or disruption of automated business workflows.
Technical details
Flowise versions 3.0.1 through 3.0.8 (and later versions where 'ALLOW_BUILTIN_DEP' is enabled) are vulnerable to a sandbox escape in the NodeVM execution environment. The vulnerability stems from the insecure integration of Puppeteer and Playwright modules, which allow users to specify attacker-controlled browser binary paths and command-line arguments. An authenticated attacker can create a custom tool that leverages these modules to execute arbitrary binaries on the host system, bypassing the intended NodeVM sandbox. The exploit is triggered by sending a crafted JSON object to the /api/v1/tools endpoint and executing the resulting tool via an Agentflow or Chatflow. The issue was addressed by disabling available dependencies by default in version 3.0.8.
Affected products
- FlowiseAI FlowiseAI Flowise 3.0.1 to 3.0.8; all versions after 3.0.8 if ALLOW_BUILTIN_DEP is enabled
Timeline
- 2025-09-18: patched: Pull request merged to disable dependencies by default
- 2025-10-03: advisory: Vendor advisory GHSA-5w3r-f6gm-c25w published
- 2025-10-14: disclosed: CVE-2025-34267 published to NVD