Executive brief
FlowiseAI is a low-code platform for building AI agents and workflows. The Supabase vector store component accepts unsanitized filter expressions from authenticated admin users and directly compiles and executes them as JavaScript on the backend server. An attacker with admin credentials can inject malicious code to execute arbitrary commands on the server, steal environment secrets, establish reverse shells, and completely compromise the deployment.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the Supabase vector store node located at packages/components/nodes/vectorstores/Supabase/Supabase.ts line 237. The vulnerable code accepts a user-provided supabaseRPCFilter string and compiles it directly into executable JavaScript using new Function() or similar construct with no input validation, escaping, or sandboxing. The attack vector is network-based and requires high privileges (admin authentication), but no user interaction. Once triggered, the injected code executes with the full privileges of the FlowiseAI backend process, allowing attackers to call child_process.execSync() for OS command execution, access process.mainModule.require() for module loading, and exfiltrate sensitive environment variables like JWT secrets. The vulnerability was patched in version 3.0.6.
Affected products
- FlowiseAI Flowise 3.0.5
Timeline
- 2025-09-13: disclosed
- 2025-10-17: patched: version 3.0.6