Remote Code Execution (RCE)

flowise is vulnerable to a sandbox escape and remote code execution RCE. The vulnerability is due to improper validation of attacker-controlled executablePath and args parameters in puppeteer.launch, which allows an authenticated attacker to escape the JavaScript sandbox, execute arbitrary OS...

Protection Mechanism Failure

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Protection Mechanism Failure via the vm2/@flowiseai/nodevm JavaScript sandbox in the /api/v1/node-custom-function endpoint. An authenticated attacker can supply attacker-controlled...

Protection Mechanism Failure

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Protection Mechanism Failure via the vm2/@flowiseai/nodevm JavaScript sandbox in the /api/v1/node-custom-function endpoint. An authenticated attacker can supply attacker-controlled executablePath and args...

CVE-2026-73483 Flowise before 3.1.3 Sandbox Escape via Puppeteer

Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...

PT-2026-71423

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description A sandbox escape exists in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the '/api/v1/node-custom-function' endpoint can escape the sandbox by providing...

CVE-2026-73483: Improper Neutralization of Special Elements used in an OS Command

Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...