Vulnerability · Published Jun 20, 2026 · Assigned by VulnCheck

CVE-2024-58351Flowise - Remote Code Execution via overrideConfig Parameter

Critical 9.8

In plain English

A critical-severity code injection in Flowise from Flowise. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.7%top 48.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported in both the frontend web integration and the backend Prediction API. Because this feature is enabled by default with no allow-list of permitted variables and relies on vm2 for sandboxing, an attacker can abuse it to achieve remote code execution and sandbox escape, denial of service by crashing the server, server-side request forgery, prompt injection, and server variable and data exfiltration. These issues are self-targeted and do not persist to other users.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	flowise	2.1.4	GHSA-5cph-wvm9-45gj

Affected products (as reported)

Vendor	Product	Versions
Flowise	Flowise	0 – before 2.1.4

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GHSA Advisory GHSA-5cph-wvm9-45gj vendor-advisory
VulnCheck Advisory: Flowise - Remote Code Execution via overrideConfig Parameter third-party-advisory