EUVD-2026-52742

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...

PT-2026-67749

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description A sandbox escape exists in the executeJavaScriptCode function that allows an authenticated attacker to execute arbitrary system commands as root on the server. The issue occurs because the function...