CyberRota Analysis
AI-GeneratedVersions of Flowise (packages flowise and flowise-components) up to 3.1.2 are vulnerable to a critical sandbox escape that allows authenticated users to execute arbitrary OS commands and disclose host files by manipulating parameters in the /api/v1/node-custom-function endpoint. This vulnerability poses a significant risk, particularly for environments running the official Docker image where the process user is root. Organizations using affected versions should prioritize upgrading to version 3.1.3 to mitigate this severe threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. This allows execution of arbitrary OS commands as the Flowise process user (root in the official Docker image) and arbitrary host file disclosure via Chromium's file:// URL handling. In versions 3.0.8–3.1.2 exploitation requires ALLOW_BUILTIN_DEP=true; earlier versions are exploitable by default. Fixed in 3.1.3.