Loading vulnerability…
Flowise NodeVM Sandbox Escape Remote Code Execution
Flowise and flowise-components before version 3.1.3 allow caller-controlled NodeVM options supplied to executeJavaScriptCode() to override the intended sandbox security configuration. An authenticated user able to invoke custom functions can re-enter the JavaScript execution utility with built-in Node.js modules enabled, escape the intended sandbox restrictions, and invoke operating-system command execution functionality. The issue is fixed in Flowise 3.1.3.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary operating-system command execution in the security context of the Flowise service. In deployments where Flowise runs as root, this results in root-level code execution. An attacker may read sensitive server files, obtain application encryption and JWT signing material, decrypt stored credentials, forge authentication tokens, alter application data, and establish persistent access.
If you can’t patch tonight, do this now.
No separate vendor workaround is available. Until updates are applied, disable or strictly restrict custom-function execution and its associated API functionality; permit access only to highly trusted administrators, minimize API-key issuance and privileges, and prevent untrusted authenticated users from submitting custom JavaScript functions. Run the Flowise service under a dedicated non-root account to reduce impact if exploitation occurs.
Patch, then assume compromise.
Upgrade Flowise and flowise-components to version 3.1.3 or later. Ensure deployed application images, package installations, and lockfiles resolve both affected packages to patched versions, then redeploy or restart the Flowise service.
No validated public exploits yet. Hidden: 3 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.