CyberRota Analysis
AI-GeneratedThe vm2 JavaScript sandbox in Flowise versions prior to 3.1.3 is vulnerable to a sandbox escape, allowing authenticated users to execute arbitrary code through a moment locale validation bypass. This vulnerability enables attackers to craft malicious String objects that can bypass path traversal checks, leading to the execution of unauthorized JavaScript files from the document store. Organizations using affected versions of Flowise should prioritize patching this critical vulnerability to mitigate the risk of code execution attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to load and execute malicious JavaScript files stored in the document store outside the sandbox.