Executive brief
Flowise, a platform for building AI applications, contains a vulnerability that allows authenticated users to execute arbitrary commands on the underlying server. By providing malicious configuration settings to database connection nodes, an attacker can bypass security sandboxes and gain full control over the application and its data. This could lead to a complete system compromise, unauthorized data access, and service disruption.
Technical details
A sandbox escape and Remote Code Execution (RCE) vulnerability exists in Flowise versions 3.1.2 and earlier. The vulnerability stems from the 'additionalConfig' input in several nodes (MySQLRecordManager, PostgresRecordManager, SQLiteRecordManager, and AgentMemory), which allows users to pass arbitrary options to the TypeORM DataSource class. An attacker can abuse options such as 'entities', 'subscribers', or 'migrations' to load and execute local JavaScript files. By first uploading a malicious script via the File Loader and then referencing its path in the DataSource configuration, an authenticated attacker can execute code outside the vm2 sandbox. This issue is tracked as CVE-2026-69251 and is resolved in version 3.1.3.
Affected products
- FlowiseAI flowise <= 3.1.2
- FlowiseAI flowise-components <= 3.1.2
Timeline
- 2026-04-15: disclosed: Disclosed by Alex Brown of elttam
- 2026-07-29: patched: Patch released in version 3.1.3
- 2026-08-04: advisory: GitHub Advisory published