Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore
VulnCheck marked the affected products as already unsupported when this CVE was assigned. A patch may not be available. Review the vendor references for migration or mitigation guidance.
This tag describes support at assignment time, not current support for every related product.
Impact
Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. This allows execution of arbitrary OS commands as the Flowise process user (root in the official Docker image) and arbitrary host file disclosure via Chromium's file:// URL…
Source excerpt · OSVIn versions 3.0.8–3.1.2 exploitation requires ALLOW_BUILTIN_DEP=true; earlier versions are exploitable by default.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 3.1.3Semantic versions | 3.1.3 |
Version evidence: OSV · GHSA-9gvv-qjj3-2p6g
View original version evidence (0 explicit versions)
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 3.1.3Semantic versions | 3.1.3 |
Version evidence: OSV · GHSA-9gvv-qjj3-2p6g
View original version evidence (0 explicit versions)
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
FlowiseAI · VulnCheck
Flowise
1 range
FlowiseAI · VulnCheck
Flowise
Package identity
pkg:github/FlowiseAI/FlowiseIdentity supplied by VulnCheck. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → through 3.1.4
semver versions
Other versions: unaffected
Original source description
Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. This allows execution of arbitrary OS commands as the Flowise process user (root in the official Docker image) and arbitrary host file disclosure via Chromium's file:// URL handling. In versions 3.0.8–3.1.2 exploitation requires ALLOW_BUILTIN_DEP=true; earlier versions are exploitable by default. Fixed in 3.1.3.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-119978CVE-2026-73483View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
VulnCheck · platform conditions
Any condition may hold
Vulnerable product
cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*Through (inclusive): 3.1.4
Original applicability statements
[
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.1.4"
}
]
}
]
}
]Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.