Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Flowise, an open-source platform for building AI workflows, is affected through version 3.1.4. An authenticated user can exploit its custom function sandbox to run arbitrary operating system commands on the server with the Flowise process's privileges, potentially giving full control over the host.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth package via LocalFileStore and requires it, escaping vm2 as the Flowise process user.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- FlowiseAI Flowise
through 3.1.4