Executive brief
Flowise, a platform for building AI applications, contains a vulnerability in its SQLite Record Manager component. An authenticated user can manipulate database settings to write malicious files to sensitive areas of the server's filesystem. Because the application often runs with high system privileges (root), this allows an attacker to execute arbitrary commands on the underlying server, potentially leading to a full system takeover and theft of sensitive data.
Technical details
A vulnerability in the `SQLiteRecordManager.ts` component of Flowise allows for Remote Code Execution (RCE). The `init` method of the `SQLiteRecordManager_RecordManager` class uses keyword argument expansion (`...additionalConfiguration`) after the default `database` path is set, allowing a user-controlled `additionalConfig` input to overwrite the SQLite database file path. By specifying a path such as `/etc/chromium/exploit.conf` and crafting a malicious SQLite database (leveraging specific table name lengths to bypass regex validation and inject shell commands into the database binary structure), an attacker can achieve code execution when the system later invokes Puppeteer/Chromium. This is particularly impactful as the official Docker images run as the root user. The issue is addressed in version 3.1.3.
Affected products
- FlowiseAI flowise <= 3.1.2
- FlowiseAI flowise-components <= 3.1.2
Timeline
- 2026-04-24: disclosed: Initial disclosure by Alex Brown
- 2026-07-29: advisory
- 2026-08-04: patched: Updated advisory and patch verification