Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

Description

A sandbox escape vulnerability in executeJavaScriptCode() allows any authenticated user to execute arbitrary system commands as root on the Flowise server.

Recommendation

Update the flowise-components package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.1.2
• Patched version(s): 3.1.3

References

• GHSA-3769-jgqc-cxm7
• CVE-2026-69254
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Flowise Sandbox Escape to RCE - CVE-2026-69253
• Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox - CVE-2026-41270
• Flowise: Authenticated RCE Via MCP Adapters - CVE-2026-40933
• Flowise RCE via SQLite Record Manager Node - CVE-2026-69259

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

flowise-components