CVE-2026-69254: Flowise NodeVM sandbox escape in executeJavaScriptCode

CVE-2026-69254 · Severity: critical · CVSS 8.8 · Published 2026-08-04

Flowise is a visual AI agent builder that allows authenticated users to create custom workflows. A vulnerability in its JavaScript execution sandbox allows any logged-in user with an API key to escape the security restrictions and execute arbitrary system commands as the root user. This enables attackers to steal sensitive encryption keys, forge authentication tokens, access all stored credentials, and gain persistent control of the server.

Technologies: flowise (npm), flowise-components (npm). Vendors: npm.

Quick answers

Is CVE-2026-69254 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-69254 being exploited in the wild.
How severe is CVE-2026-69254?
Critical severity, with a CVSS score of 8.8, published 4 August 2026.
Which products and versions are affected?
flowise (npm) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.3; flowise-components (npm) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.3.
Is there a fix for CVE-2026-69254?
Yes. flowise (npm): upgrade to 3.1.3 or later; flowise-components (npm): upgrade to 3.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69254 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-69254?
Check whether you run flowise (npm) or flowise-components (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • flowise (npm): upgrade to 3.1.3 or later
    npm install flowise@3.1.3
  • flowise-components (npm): upgrade to 3.1.3 or later
    npm install flowise-components@3.1.3

Technical details

The vulnerability exists in packages/components/src/utils.ts where executeJavaScriptCode() merges user-provided nodeVMOptions into default sandbox settings using the spread operator: `const finalNodeVMOptions = { ...defaultNodeVMOptions, ...nodeVMOptions }`. This allows authenticated callers to override the require.builtin allowlist with `["*"]`, permitting access to all Node.js built-in modules including child_process and fs. The attack chain begins with a custom function endpoint accepting caller-controlled JavaScript code, which runs inside a NodeVM sandbox. An attacker can require the flowise-components utility module by absolute path, obtain a reference to executeJavaScriptCode itself, and recursively call it with malicious nodeVMOptions. Inside the nested VM, require("child_process") succeeds, enabling command execution as root. The vulnerability affects versions &lt;= 3.1.2 and is fixed in 3.1.3. Authentication is required but is not restrictive—any user who can register an account and obtain an API key can exploit this.

Affected products

  • FlowiseAI Flowise >=3.0.5 through 3.1.2
  • FlowiseAI flowise-components <=3.1.2

Identifiers

  • CVE-2026-69254
  • GHSA-3769-jgqc-cxm7

Timeline

  • 2026-08-04: disclosed: Advisory published by GitHub Security Advisory
  • 2026-06-25: patched: Fix released in version 3.1.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.