Executive brief
Flowise is an open-source platform for building and running LLM-based applications and workflows. The application allows users to inject configuration into running workflows via the overrideConfig option, which is enabled by default with no restrictions. An attacker can exploit this to execute arbitrary code on the server, bypass the sandbox environment, cause denial of service, perform server-side request forgery, or steal sensitive data.
Technical details
This is a code injection vulnerability (CWE-94) in Flowise's overrideConfig feature. The feature allows arbitrary configuration values to be passed during workflow execution via both the REST API and web frontend, but lacks an allow-list mechanism to restrict which configuration parameters can be modified. The vulnerability relies on vm2 for sandboxing, which the vm2 author has stated cannot be reliably fixed. An unauthenticated, network-adjacent attacker can inject malicious configuration to achieve remote code execution, escape the sandbox, cause denial of service by crashing the server, perform server-side request forgery, inject prompts sent to language models, or exfiltrate server variables and sensitive data. The feature is enabled by default with no authentication requirement. Patches are available in version 2.1.4 and later.
Affected products
- Flowise Flowise < 2.1.4
Timeline
- 2024-11-21: disclosed: Original advisory GHSA-5cph-wvm9-45gj published
- 2024-11-21: patched: Version 2.1.4 released with patches
- 2026-06-20: other: Duplicate advisory GHSA-5w6g-rc45-wvv9 published to NVD
- 2026-09-14: other: Duplicate advisory withdrawn