CVE-2026-119978

Versions of Flowise through 3.1.4 are vulnerable to a sandbox escape vulnerability leading to Remote Code Execution (RCE) . When ALLOW_BUILTIN_DEP=true is enabled, an authenticated user can submit malicious JavaScript to the /api/v1/node-custom-function endpoint. This allows the attacker to abuse...