Duplicate Advisory: Flowise contains an unauthenticated sandbox escape

Severity: high · CVSS 8.8 · Published 2026-08-13

# Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9gvv-qjj3-2p6g. This link is maintained to preserve external references.

# Original Description

Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the `vm2/@flowiseai/nodevm` JavaScript sandbox. An authenticated user with access to the `/api/v1/node-custom-function` endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. This allows execution of arbitrary OS commands as the Flowise process user (root in the official Docker image) and arbitrary host file disclosure via Chromium's `file://` URL handling. In versions 3.0.8–3.1.2 exploitation requires `ALLOW_BUILTIN_DEP=true`; earlier versions are exploitable by default. Fixed in 3.1.3.

Technologies: flowise (npm), flowise-components (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 8.8, published 13 August 2026.
Which products and versions are affected?
flowise (npm) <= 3.1.2; flowise-components (npm) <= 3.1.2.
Is there a fix for This vulnerability?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected?
Check whether you run flowise (npm) or flowise-components (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • flowise (npm) <= 3.1.2
  • flowise-components (npm) <= 3.1.2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.