All vulnerabilities
CVE-2026-69254GHSA-3769-jgqc-cxm7

Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

FlowiseAI FlowisenpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.4Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 4 Aug 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.69%Chance of exploitation activity in the next 30 days, higher than 52% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.1.3Fixed versionOSV
Published4 Aug 2026Updated 4 Aug 2026CVE List

What fixes it

  • 3.1.3flowise, npmOSVnpm install flowise@3.1.3
  • 3.1.3flowise-components, npmOSVnpm install flowise-components@3.1.3

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 4 Aug 2026, 15:28 UTCPublishedCVE List
  2. 23 Oct 2026, 23:36 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode() accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching packages/server/src/routes/node-custom-functions/index.ts could run a custom function that imported flowise-components/dist/src/utils.js, called executeJavaScriptCode() again with nodeVMOptions.require.builtin set to allow all built-in modules, and then required child_process to execute arbitrary system commands as root on the Flowise server. This issue is fixed in version 3.1.3.

Text from CVE List

Affected versions 3

  • Flowiseaffected: < 3.1.3CVE List
  • flowise, npmfrom first release, fixed in 3.1.3OSV
  • flowise-components, npmfrom first release, fixed in 3.1.3OSV

References 4