PT-2026-67748

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description An authenticated user can achieve remote code execution on the Flowise server by escaping the vm2 sandbox. The issue exists in the AgentAsTool, ChatflowTool, and ExecuteFlow custom-tool components,...

CVE-2026-69253: Improper Neutralization of Directives in Dynamically Evaluated Code

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that code, they inserted a user-controlled...