CVE-2026-46442: Flowise remote code execution via NodeVM sandbox escape in Custom JS Function

Executive brief

FlowiseAI, a platform for building LLM applications, contains a vulnerability that allows any user with a valid account or API key to execute commands on the underlying server. By submitting malicious code to a specific internal function, an attacker can bypass security restrictions and gain full control over the server host. This could lead to the theft of sensitive credentials, access to private data, or a complete shutdown of the service.

Technical details

The vulnerability consists of two parts: first, the `POST /api/v1/node-custom-function` endpoint lacks route-level authorization, allowing any authenticated user or API key holder to access it. Second, when the `E2B_APIKEY` environment variable is not set, the application falls back to using `@flowiseai/nodevm` for code execution. An attacker can exploit an exception path where an Error object escapes the NodeVM boundary, allowing them to recover the host's Function constructor and execute system commands via the `child_process` module. This results in full remote code execution (RCE) on the host server. The issue is fixed in version 3.1.2.

Affected products

• FlowiseAI flowise <= 3.1.1

Timeline

• 2026-05-14: disclosed
• 2026-05-14: advisory
• 2026-05-14: patched: Fixed in version 3.1.2

References

• https://api.github.com/users/ESPanda666
• https://github.com/ESPanda666
• https://api.github.com/users/ESPanda666/gists%7B/gist_id%7D
• https://api.github.com/users/ESPanda666/repos
• https://avatars.githubusercontent.com/u/136694812?v=4
• https://api.github.com/users/ESPanda666/events%7B/privacy%7D