Is CVE-2026-69251 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-69251 being exploited in the wild.

How severe is CVE-2026-69251?

Critical severity, with a CVSS score of 8.8, published 4 August 2026.

Which products and versions are affected?

flowise (npm) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.3; flowise-components (npm) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.3.

Is there a fix for CVE-2026-69251?

Yes. flowise (npm): upgrade to 3.1.3 or later; flowise-components (npm): upgrade to 3.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-69251 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-69251?

Check whether you run flowise (npm) or flowise-components (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-69251: Flowise RCE via TypeORM DataSource configuration

Q: Which products and versions are affected?

flowise (npm) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.3; flowise-components (npm) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.3.

Q: Is there a fix for CVE-2026-69251?

Yes. flowise (npm): upgrade to 3.1.3 or later; flowise-components (npm): upgrade to 3.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-69251 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-69251?

Check whether you run flowise (npm) or flowise-components (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-69251 · Severity: critical · CVSS 8.8 · Published 2026-08-04

Flowise, a platform for building AI applications, contains a vulnerability that allows authenticated users to execute arbitrary commands on the underlying server. By providing malicious configuration settings to database connection nodes, an attacker can bypass security sandboxes and gain full control over the application and its data. This could lead to a complete system compromise, unauthorized data access, and service disruption.

Technologies: flowise (npm), flowise-components (npm). Vendors: npm.

Quick answers

Is CVE-2026-69251 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-69251 being exploited in the wild.
How severe is CVE-2026-69251?: Critical severity, with a CVSS score of 8.8, published 4 August 2026.
Which products and versions are affected?: flowise (npm) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.3; flowise-components (npm) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.3.
Is there a fix for CVE-2026-69251?: Yes. flowise (npm): upgrade to 3.1.3 or later; flowise-components (npm): upgrade to 3.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69251 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-69251?: Check whether you run flowise (npm) or flowise-components (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

flowise (npm): upgrade to 3.1.3 or later
```
npm install flowise@3.1.3
```
flowise-components (npm): upgrade to 3.1.3 or later
```
npm install flowise-components@3.1.3
```

Technical details

A sandbox escape and Remote Code Execution (RCE) vulnerability exists in Flowise versions 3.1.2 and earlier. The vulnerability stems from the 'additionalConfig' input in several nodes (MySQLRecordManager, PostgresRecordManager, SQLiteRecordManager, and AgentMemory), which allows users to pass arbitrary options to the TypeORM DataSource class. An attacker can abuse options such as 'entities', 'subscribers', or 'migrations' to load and execute local JavaScript files. By first uploading a malicious script via the File Loader and then referencing its path in the DataSource configuration, an authenticated attacker can execute code outside the vm2 sandbox. This issue is tracked as CVE-2026-69251 and is resolved in version 3.1.3.

Affected products

FlowiseAI flowise <= 3.1.2
FlowiseAI flowise-components <= 3.1.2

Identifiers

CVE-2026-69251
GHSA-g32j-mmxr-gfq5

Timeline

2026-04-15: disclosed: Disclosed by Alex Brown of elttam
2026-07-29: patched: Patch released in version 3.1.3
2026-08-04: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.