CVE-2026-69254: Flowise LLM Builder RCE Vulnerability

CVE-2026-69254 Overview

CVE-2026-69254 is a code injection vulnerability [CWE-94] in Flowise, a drag-and-drop user interface for building customized large language model (LLM) flows. Versions prior to 3.1.3 allow authenticated attackers to escape the NodeVM sandbox and execute arbitrary system commands as root on the Flowise server. The executeJavaScriptCode() function in packages/components/src/utils.ts accepts caller-provided nodeVMOptions and merges them over the default NodeVM security settings. An attacker with access to the node-custom-functions route can override sandbox restrictions and load the child_process module. The issue is fixed in version 3.1.3.

Critical Impact
Authenticated attackers can execute arbitrary operating system commands as root by bypassing the NodeVM sandbox through user-controlled nodeVMOptions.require.builtin settings.

Affected Products

Flowise versions prior to 3.1.3
packages/components/src/utils.ts component (executeJavaScriptCode())
packages/server/src/routes/node-custom-functions/index.ts route handler

Discovery Timeline

2026-08-04 - CVE-2026-69254 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-69254

Vulnerability Analysis

Flowise uses NodeVM to sandbox user-supplied JavaScript executed inside custom function nodes. The executeJavaScriptCode() helper in packages/components/src/utils.ts constructs a NodeVM instance with restrictive defaults that block dangerous built-in modules. The flaw arises because the function accepts a nodeVMOptions parameter from callers and merges it on top of those defaults. An authenticated attacker who reaches the node-custom-functions route can author a custom function that imports flowise-components/dist/src/utils.js and calls executeJavaScriptCode() again with attacker-controlled options. Setting nodeVMOptions.require.builtin to allow all built-in modules re-enables child_process, permitting arbitrary command execution as the Flowise process user (root in default deployments).

Root Cause

The root cause is unsafe option merging in executeJavaScriptCode(). Caller-provided sandbox configuration overrides the security-critical defaults, giving untrusted code the ability to specify its own execution environment. This is a classic control-plane confusion between security policy and untrusted input, classified as [CWE-94] Improper Control of Generation of Code.

Attack Vector

The attack requires authenticated access to the Flowise server and network reachability to the node-custom-functions API route. The attacker submits a custom function whose body re-imports the internal utils module and re-invokes executeJavaScriptCode() with nodeVMOptions.require.builtin set to ['*'] or equivalent. The nested invocation runs inside a NodeVM with all built-in modules enabled, allowing require('child_process').exec() to execute shell commands on the host.

typescript

// Patch excerpt from packages/components/src/utils.ts
// Source: https://github.com/FlowiseAI/Flowise/commit/3086cb7e323bb96c5a581d3232ef975b0d92183d
+import { GetSecretValueCommand, SecretsManagerClient, SecretsManagerClientConfig } from '@aws-sdk/client-secrets-manager'
+import { Sandbox } from '@e2b/code-interpreter'
+import { DocumentLoader } from '@langchain/classic/document_loaders/base'
+import { Document } from '@langchain/core/documents'
+import { BaseChatModel } from '@langchain/core/language_models/chat_models'
+import { AIMessage, AIMessageChunk, BaseMessage, HumanMessage } from '@langchain/core/messages'
+import { Runnable, type RunnableConfig } from '@langchain/core/runnables'
+import { TextSplitter } from '@langchain/textsplitters'
 import axios from 'axios'
 import { load } from 'cheerio'
+import { AES, enc } from 'crypto-js'
 import * as fs from 'fs'
-import * as path from 'path'
 import { JSDOM } from 'jsdom'
-import { z } from 'zod/v3'
-import { cloneDeep, omit, get } from 'lodash'
+import JSON5 from 'json5'
+import { cloneDeep, get, omit } from 'lodash'
+import * as path from 'path'
 import TurndownService from 'turndown'
 import { DataSource, Equal } from 'typeorm'

The upstream fix in commit 3086cb7e323bb96c5a581d3232ef975b0d92183d restructures executeJavaScriptCode() so caller-provided options can no longer override the security-critical NodeVM defaults for built-in module access.

Detection Methods for CVE-2026-69254

Indicators of Compromise

Unexpected child_process, spawn, or exec invocations originating from the Flowise Node.js process.
New or modified custom function definitions that import flowise-components/dist/src/utils.js and reference nodeVMOptions.
Outbound network connections or shell commands (sh, bash, curl, wget) launched by the Flowise server user.
Root-owned files or cron entries created after custom function execution events.

Detection Strategies

Audit stored Flowise custom functions for strings such as nodeVMOptions, require.builtin, child_process, or dynamic requires of flowise-components.
Monitor process ancestry on the Flowise host for child processes spawned by the Node.js runtime that are not part of normal LLM flow execution.
Correlate HTTP requests to /api/v1/node-custom-functions with subsequent shell activity on the same host.

Monitoring Recommendations

Enable authentication and access logging on all Flowise API routes and forward logs to a centralized store.
Alert on any process spawn from the Flowise Node.js binary whose command line is not part of a known allowlist.
Track file integrity of packages/components/src/utils.ts and installed flowise-components package versions.

How to Mitigate CVE-2026-69254

Immediate Actions Required

Upgrade Flowise to version 3.1.3 or later, which contains the fix from pull request #6306.
Rotate any credentials, API keys, and secrets accessible from the Flowise server, since exploitation yields root-level command execution.
Review audit logs for suspicious custom function submissions and executions since the vulnerable version was deployed.
Restrict network access to the Flowise management interface to trusted administrators only.

Patch Information

The fix is available in Flowise 3.1.3. See the GitHub Security Advisory GHSA-3769-jgqc-cxm7, the release notes for flowise@3.1.3, and the remediation commit. The patch prevents caller-supplied nodeVMOptions from overriding the default NodeVM security settings in executeJavaScriptCode().

Workarounds

Disable the node-custom-functions route or restrict it to trusted operators until the upgrade is applied.
Run the Flowise process as an unprivileged user inside a container with a read-only filesystem and no outbound network egress.
Enforce strict authentication and role-based access control to prevent low-privilege users from creating custom functions.

bash

# Upgrade Flowise to the patched version
npm install -g flowise@3.1.3

# Or, if running via Docker, pull the fixed image tag
docker pull flowiseai/flowise:3.1.3
docker stop flowise && docker rm flowise
docker run -d --name flowise \
  --user 1000:1000 \
  --read-only \
  -p 3000:3000 \
  flowiseai/flowise:3.1.3