Executive brief
Flowise is a visual AI agent builder that allows dynamic configuration injection during workflow execution. The overrideConfig feature, enabled by default without protective restrictions, permits attackers to inject malicious code that escapes the sandbox environment and executes on the server. This can lead to complete system compromise, data theft, service disruption, and unauthorized API calls to third-party systems.
Technical details
Flowise versions before 2.1.4 contain an improper code generation vulnerability (CWE-94) in the overrideConfig feature, which accepts user-supplied configuration objects that are evaluated during Chainflow execution. The vulnerability stems from reliance on the vm2 sandbox library for code isolation without an allow-list of permitted configuration variables. An unauthenticated, network-adjacent attacker can craft malicious configuration payloads via the REST Prediction API or frontend web integration to escape the vm2 sandbox, execute arbitrary code on the host server, trigger denial of service, perform server-side request forgery, inject prompts into LLM interactions, and exfiltrate sensitive variables and application data. The issues are self-contained and do not persist across users. Flowise 2.1.4 and later apply fixes including disabling overrideConfig by default and implementing proper input validation.
Affected products
- FlowiseAI Flowise <2.1.4
Timeline
- 2024-11-21: disclosed: Original advisory GHSA-5cph-wvm9-45gj published
- 2026-06-20: other: Duplicate advisory GHSA-5w6g-rc45-wvv9 published
- 2026-06-20: patched: Flowise 2.1.4 released with fixes
- 2026-09-14: other: Duplicate advisory GHSA-5w6g-rc45-wvv9 withdrawn