Executive brief
Flowise, a tool for building LLM-based applications, contains a vulnerability that allows authenticated users to bypass security restrictions. By exploiting a flaw in how custom code is executed, an attacker can gain full control over the server. This could lead to the theft of sensitive credentials, database passwords, and complete system takeover.
Technical details
A sandbox escape exists in the `executeJavaScriptCode()` function within `packages/components/src/utils.ts`. The vulnerability stems from the use of the JavaScript spread operator to merge user-provided `nodeVMOptions` with `defaultNodeVMOptions`, allowing the caller to override security settings such as the `require.builtin` allowlist. An attacker can exploit this by requiring the `utils.js` module via an absolute path to access `executeJavaScriptCode()` from within the sandbox, then calling it again with overridden options to enable the `child_process` module. This results in remote code execution (RCE) with root privileges. The issue is patched in version 3.1.3.
Affected products
- FlowiseAI flowise <= 3.1.2
- FlowiseAI flowise-components <= 3.1.2
Timeline
- 2026-07-29: disclosed
- 2026-08-04: advisory
- 2026-08-04: patched