CVE-2026-69253: Flowise LLM Platform RCE Vulnerability

CVE-2026-69253 Overview

CVE-2026-69253 is a code injection vulnerability in Flowise, a drag-and-drop interface for building large language model (LLM) flows. Versions prior to 3.1.3 embed a user-controlled baseURL value directly into JavaScript source code executed inside the vm2 sandbox. The affected components are AgentAsTool, ChatflowTool, and ExecuteFlow. An authenticated attacker can craft a baseURL that passes the isValidURL check while including characters that break out of the surrounding string literal. Injected JavaScript escapes the vm2 sandbox and runs arbitrary code on the Flowise server as the Flowise process user. The issue is tracked as [CWE-95] and fixed in Flowise 3.1.3.

Critical Impact
Authenticated attackers can achieve remote code execution on the Flowise host by injecting JavaScript through the baseURL field of custom tool components.

Affected Products

Flowise versions prior to 3.1.3
AgentAsTool custom tool component
ChatflowTool and ExecuteFlow custom tool components

Discovery Timeline

2026-08-04 - CVE-2026-69253 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-69253

Vulnerability Analysis

Flowise builds tool code dynamically by concatenating a user-supplied baseURL into a JavaScript template such as const url = "${baseURL}/...";. The resulting string is passed to the in-process vm2 sandbox for execution. Because the value lands inside a JavaScript string literal, any characters that terminate the quoted string enable arbitrary code injection. The isValidURL check accepts URLs containing quote characters, backticks, or other syntactic breakers.

Once injected, attacker-controlled JavaScript runs inside vm2. The vm2 project has documented sandbox escape techniques, and Flowise exposes risky dependencies to the sandboxed context. Combined, these conditions let the injected payload break out of vm2 and execute arbitrary code in the Node.js process. Exploitation requires only an authenticated session, and the attacker gains the privileges of the Flowise process user.

Root Cause

The root cause is unsafe construction of executable code from untrusted input. Input validation was limited to URL syntax rather than escaping or parameterization. The fix in version 3.1.3 passes the URL into the sandbox as data rather than embedding it in source, and it adds stricter URL validation.

Attack Vector

An authenticated user with permission to configure custom tools submits a malicious baseURL value. The value passes isValidURL yet contains characters that close the JavaScript string and append attacker JavaScript. When the tool executes, the payload runs inside vm2, escapes the sandbox using known vm2 weaknesses, and executes shell commands or additional payloads on the host.

text

# Patch excerpt from docker/.env.example (fix: FLOWISE-400, 543, 551 #6417)
# TOOL_FUNCTION_BUILTIN_DEP=crypto,fs
-# TOOL_FUNCTION_EXTERNAL_DEP=moment,lodash
+# TOOL_FUNCTION_EXTERNAL_DEP=moment,lodash,pg,mysql2,mongodb,ioredis,redis,typeorm,puppeteer,playwright,@zilliz/milvus2-sdk-node
# ALLOW_BUILTIN_DEP=false

Source: GitHub Commit 3f257bd. The patch narrows the allowed dependency surface in TOOL_FUNCTION_EXTERNAL_DEP alongside the code-level fix that treats baseURL as data instead of inlining it into source.

Detection Methods for CVE-2026-69253

Indicators of Compromise

Unexpected outbound network connections initiated by the Flowise Node.js process to attacker-controlled hosts.
Child processes spawned by the Flowise service, such as /bin/sh, bash, curl, or wget, which are unusual for the parent process.
Modifications to files owned by the Flowise process user outside the application data directory.
baseURL values in stored tool configurations containing quote characters, backticks, template literal syntax, or JavaScript keywords.

Detection Strategies

Inspect the Flowise database and configuration store for AgentAsTool, ChatflowTool, and ExecuteFlow records whose baseURL fields include characters beyond a normal URL character set.
Enable Node.js process auditing and alert on unexpected child_process.spawn, exec, or require invocations originating from tool execution.
Correlate authenticated Flowise API activity that creates or updates custom tools with subsequent process or network anomalies on the host.

Monitoring Recommendations

Forward Flowise application logs and host telemetry to a centralized analytics platform to correlate tool configuration changes with runtime behavior.
Monitor vm2-based execution logs, if enabled, for syntax errors or unusual runtime exceptions that may indicate exploitation attempts.
Track authenticated user actions that create custom tools and flag accounts that modify baseURL values frequently.

How to Mitigate CVE-2026-69253

Immediate Actions Required

Upgrade Flowise to version 3.1.3 or later, which passes baseURL to the sandbox as data and applies stricter URL validation.
Restrict access to the Flowise UI and API to trusted, authenticated users only, and remove unused accounts.
Audit existing AgentAsTool, ChatflowTool, and ExecuteFlow configurations for suspicious baseURL content and remove or reset entries as needed.
Rotate any credentials, API keys, or tokens stored on the Flowise host if compromise is suspected.

Patch Information

The fix is included in Flowise 3.1.3. See the GitHub Security Advisory GHSA-wg86-r78f-74mp, the GitHub Pull Request #6417, and the Flowise 3.1.3 Release.

Workarounds

If immediate upgrade is not possible, disable the AgentAsTool, ChatflowTool, and ExecuteFlow components in your Flowise deployment.
Limit custom tool creation privileges to a small set of administrators and audit their activity.
Place Flowise behind network segmentation and egress filtering to constrain the impact of code execution on the host.

bash

# Upgrade example for a Docker deployment
docker pull flowiseai/flowise:3.1.3
docker stop flowise && docker rm flowise
docker run -d --name flowise -p 3000:3000 flowiseai/flowise:3.1.3