Description
Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth package via LocalFileStore and requires it, escaping vm2 as the Flowise process user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FlowiseAI | Flowise | ≤ 3.1.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | flowise | < 3.1.3 | 3.1.3 | GHSA-9gvv-qjj3-2p6g |
| npm | flowise-components | < 3.1.3 | 3.1.3 | GHSA-9gvv-qjj3-2p6g |
Advisories 1
- WID-SEC-2026-4270 Flowise: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes BSI CERT-Bund (WID) · Nov 1, 2026
References
- Researcher write-up technical-description
- https://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c95/packages/components/src/utils.ts#L55-L114 technical-description
- https://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c95/packages/components/src/utils.ts#L1733 technical-description
- GitHub Security Advisory (GHSA-9gvv-qjj3-2p6g) related
- https://github.com/FlowiseAI/Flowise product
- VulnCheck Advisory: Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore third-party-advisory