Vulnerability · Published Aug 4, 2026 · Assigned by GitHub_M
CVE-2026-69254Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
Critical 9.4
In plain English
A critical-severity code injection in Flowise from FlowiseAI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode() accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching packages/server/src/routes/node-custom-functions/index.ts could run a custom function that imported flowise-components/dist/src/utils.js, called executeJavaScriptCode() again with nodeVMOptions.require.builtin set to allow all built-in modules, and then required child_process to execute arbitrary system commands as root on the Flowise server. This issue is fixed in version 3.1.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | flowise | 3.1.3 | GHSA-3769-jgqc-cxm7 |
| npm | flowise-components | 3.1.3 | GHSA-3769-jgqc-cxm7 |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3769-jgqc-cxm7 x_refsource_CONFIRM
- https://github.com/FlowiseAI/Flowise/pull/6306 x_refsource_MISC
- https://github.com/FlowiseAI/Flowise/commit/3086cb7e323bb96c5a581d3232ef975b0d92183d x_refsource_MISC
- https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3 x_refsource_MISC