Loading vulnerability…
Flowise Custom-Tool vm2 Sandbox Escape RCE
CVE-2026-69253 is a code-injection vulnerability in Flowise versions prior to 3.1.3. The AgentAsTool, ChatflowTool, and ExecuteFlow custom-tool components constructed JavaScript for execution in an in-process vm2 sandbox by directly interpolating the user-controlled baseURL value into a quoted JavaScript string. The isValidURL check did not prevent URL values containing characters that could terminate the string context. An authenticated attacker could supply a syntactically valid crafted baseURL, inject JavaScript into the generated sandboxed script, and leverage exposed dependencies to escape vm2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in arbitrary code execution on the Flowise server with the privileges of the Flowise process user. This can enable compromise of the application and resources accessible to that process, including loss of confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
Until the fixed version is deployed, disable or restrict the affected custom-tool functionality and prevent untrusted or lower-privileged users from configuring custom JavaScript execution paths. Do not treat vm2 as a security boundary for untrusted code; migrate untrusted-code execution to a stronger isolation mechanism.
Patch, then assume compromise.
Upgrade Flowise and its associated components to version 3.1.3 or later. The fixed release passes URLs into the sandbox as data rather than interpolating them into generated JavaScript and implements stricter URL validation. Updating vm2 alone does not remediate this flaw.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.