# CVE-2025-34267: Flowise remote code execution via Puppeteer and Playwright sandbox escape

Source: https://junglewise.ai/threats/cve-2025-34267-flowise-remote-code-execution-via-puppeteer-and-playwright  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2025-34267 · Severity: critical · CVSS 9.9 · Published 2025-10-14

Flowise, an open-source platform for building AI agents and workflows, contains a vulnerability that allows authenticated users to execute arbitrary commands on the underlying server. By creating a custom tool that uses built-in browser automation modules, an attacker can bypass security restrictions to run malicious code. This could lead to a complete takeover of the server, theft of sensitive AI training data, or disruption of automated business workflows.

Technologies: [flowise (npm)](https://junglewise.ai/threats/technologies/flowise). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-34267 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-34267 being exploited in the wild.

**How severe is CVE-2025-34267?** Critical severity, with a CVSS score of 9.9, published 14 October 2025.

**Which products and versions are affected?** flowise (npm) SEMVER:introduced=3.0.1,fixed=3.0.8.

**Is there a fix for CVE-2025-34267?** Yes. flowise (npm): upgrade to 3.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-34267 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-34267?** Check whether you run flowise (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- flowise (npm): upgrade to 3.0.8 or later

  ```sh
  npm install flowise@3.0.8
  ```


## Technical details

Flowise versions 3.0.1 through 3.0.8 (and later versions where 'ALLOW_BUILTIN_DEP' is enabled) are vulnerable to a sandbox escape in the NodeVM execution environment. The vulnerability stems from the insecure integration of Puppeteer and Playwright modules, which allow users to specify attacker-controlled browser binary paths and command-line arguments. An authenticated attacker can create a custom tool that leverages these modules to execute arbitrary binaries on the host system, bypassing the intended NodeVM sandbox. The exploit is triggered by sending a crafted JSON object to the /api/v1/tools endpoint and executing the resulting tool via an Agentflow or Chatflow. The issue was addressed by disabling available dependencies by default in version 3.0.8.

## Affected products

- FlowiseAI FlowiseAI Flowise 3.0.1 to 3.0.8; all versions after 3.0.8 if ALLOW_BUILTIN_DEP is enabled

## Identifiers

- CVE-2025-34267
- GHSA-r4hh-pcgx-j5r2

## Timeline

- 2025-09-18: patched: Pull request merged to disable dependencies by default
- 2025-10-03: advisory: Vendor advisory GHSA-5w3r-f6gm-c25w published
- 2025-10-14: disclosed: CVE-2025-34267 published to NVD

## References

- [https://flowiseai.com/](https://flowiseai.com/)
- [https://github.com/FlowiseAI/Flowise/pull/5231](https://github.com/FlowiseAI/Flowise/pull/5231)
- [https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5w3r-f6gm-c25w](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5w3r-f6gm-c25w)
- [https://www.vulncheck.com/advisories/flowise-auth-command-execution-and-sandbox-bypass-via-puppeteer-and-playwright-packages](https://www.vulncheck.com/advisories/flowise-auth-command-execution-and-sandbox-bypass-via-puppeteer-and-playwright-packages)

## Related threats

- [Duplicate Advisory: INVITED users auto-promoted via SSO email match (invite-token bypass)](https://junglewise.ai/threats/duplicate-advisory-invited-users-auto-promoted-via-sso-email-match-d290aa10)
- [Duplicate Advisory: Flowise contains an unauthenticated sandbox escape](https://junglewise.ai/threats/duplicate-advisory-flowise-contains-an-unauthenticated-sandbox-escape-8959e167)
- [Flowise incomplete credential redaction in API](https://junglewise.ai/threats/cve-2026-73604-flowise-incomplete-credential-redaction-in-api)
- [Flowise text-to-speech endpoint credential abuse via unauthenticated access](https://junglewise.ai/threats/cve-2026-73603-flowise-text-to-speech-endpoint-credential-abuse-via)
- [Flowise IDOR in payment source endpoint](https://junglewise.ai/threats/cve-2026-73488-flowise-idor-in-payment-source-endpoint)