CVE-2026-69259: Flowise SQLite Record Manager RCE Flaw

CVE-2026-69259 Overview

CVE-2026-69259 is a code injection vulnerability [CWE-94] in Flowise, a drag-and-drop interface for building large language model workflows. The flaw affects the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts prior to version 3.1.3. The component accepts user-controlled additionalConfig and spreads it after the intended database setting, allowing additionalConfig.database to overwrite the SQLite database path. An authenticated attacker can write a SQLite file to arbitrary locations and achieve code execution when Puppeteer launches Chromium and sources shell configuration files.

Critical Impact
Authenticated attackers on the published Docker image, which runs as root, can achieve remote code execution by planting shell syntax inside a SQLite file at /etc/chromium/exploit.conf.

Affected Products

Flowise versions prior to 3.1.3
Flowise official Docker image (runs as root)
Deployments using the SQLite Record Manager node

Discovery Timeline

2026-08-04 - CVE-2026-69259 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-69259

Vulnerability Analysis

The vulnerability resides in the SQLite Record Manager node. The node constructs its database configuration object and then merges user-supplied additionalConfig values on top of the defaults using object spread. Because the spread occurs after the intended database property is set, an attacker-supplied additionalConfig.database overwrites the sanctioned SQLite file path.

By setting database to a path such as /etc/chromium/exploit.conf, the attacker forces Flowise to create a SQLite file at a directory Chromium later reads. The attacker further controls the tableName and namespace value fields that Flowise writes into the SQLite file. Because SQLite files contain textual CREATE TABLE statements and inserted string values verbatim, shell syntax embedded in those fields survives into the resulting file. When Puppeteer launches Chromium, the startup process sources /etc/chromium/*.conf, evaluating the attacker-controlled content as shell commands. The Docker image executes as root, so the resulting command runs with root privileges.

Root Cause

The root cause is unsafe object merging of untrusted configuration input. The node spreads additionalConfig without allow-listing keys or re-asserting the trusted database value afterward, permitting path overwrite that leads to arbitrary file write and, ultimately, code injection.

Attack Vector

Exploitation requires an authenticated user with the ability to configure a Record Manager node. The attacker submits a workflow containing crafted additionalConfig.database, tableName, and namespace values. Flowise writes the SQLite artifact to the specified path. The payload triggers on the next Puppeteer-driven Chromium launch.

typescript

// Patch excerpt: packages/components/nodes/chains/SqlDatabaseChain/SqlDatabaseChain.ts
 import { ICommonObject, INode, INodeData, INodeParams, IServerSideEventStreamer } from '../../../src/Interface'
 import { ConsoleCallbackHandler, CustomChainHandler, additionalCallbacks } from '../../../src/handler'
 import { getBaseClasses, getInputVariables, transformBracesWithColon } from '../../../src/utils'
+import { validateSQLitePath } from '../../../src/validator'
 import { checkInputs, Moderation, streamResponse } from '../../moderation/Moderation'
 import { formatResponse } from '../../outputparsers/OutputParserHelpers'
// Source: FlowiseAI/Flowise commit d0718684

typescript

// Patch excerpt: packages/components/nodes/memory/AgentMemory/AgentMemory.ts
 import path from 'path'
 import { getBaseClasses, getCredentialData, getCredentialParam, getUserHome } from '../../../src/utils'
+import { validateSQLitePath } from '../../../src/validator'
 import { SaverOptions } from './interface'
 import { ICommonObject, IDatabaseEntity, INode, INodeData, INodeParams } from '../../../src/Interface'
 import { SqliteSaver } from './SQLiteAgentMemory/sqliteSaver'
 import { DataSource } from 'typeorm'
 import { PostgresSaver } from './PostgresAgentMemory/pgSaver'
 import { MySQLSaver } from './MySQLAgentMemory/mysqlSaver'
+import { sanitizeDataSourceOptions } from '../../../src/sanitizeDataSourceOptions'
// Source: FlowiseAI/Flowise commit d0718684

The patch adds a validateSQLitePath validator and a sanitizeDataSourceOptions helper. Together they constrain SQLite paths to safe locations and strip dangerous keys from user-supplied configuration.

Detection Methods for CVE-2026-69259

Indicators of Compromise

Unexpected files under /etc/chromium/ with a .conf extension, especially SQLite database magic headers.
Files owned by root created by the Flowise process outside the application data directory.
Puppeteer or Chromium child processes spawning shells (sh, bash) shortly after browser launch.
Workflow definitions containing SQLite Record Manager nodes with an additionalConfig.database key pointing outside normal storage paths.

Detection Strategies

Inspect stored Flowise workflow JSON for additionalConfig objects overriding database, tableName, or namespace fields with shell metacharacters.
Monitor filesystem writes to /etc/, /etc/chromium/, and other system directories originating from the Flowise container.
Alert on non-standard parent-child process trees where Chromium or Puppeteer launches interactive shells or network utilities.

Monitoring Recommendations

Enable container runtime auditing to log file creations under system configuration paths.
Correlate Flowise application logs of Record Manager configuration changes with subsequent Chromium launches.
Track outbound network connections initiated by Chromium child processes for signs of post-exploitation activity.

How to Mitigate CVE-2026-69259

Immediate Actions Required

Upgrade Flowise to version 3.1.3 or later, which introduces validateSQLitePath and sanitizeDataSourceOptions.
Rebuild and redeploy Docker images so the running container uses the patched release.
Audit existing workflows for SQLite Record Manager nodes that reference non-default database paths and remove suspicious entries.
Rotate credentials and API keys accessible to the Flowise container in case of prior exploitation.

Patch Information

The fix is delivered in Flowise 3.1.3. See the GitHub Security Advisory GHSA-x3hf-7cj6-3r4m, the pull request #6464, the commit d0718684, and the release notes for flowise@3.1.3.

Workarounds

Restrict authenticated access to Flowise to trusted users only until the upgrade is applied.
Run the Flowise container as a non-root user with a read-only root filesystem to block writes to /etc/chromium/.
Remove or disable the SQLite Record Manager node in deployments that do not require it.
Isolate the Flowise container from persistent system directories using tmpfs mounts for /etc/chromium/.

bash

# Example: run Flowise as non-root with a read-only root filesystem
docker run --rm \
  --user 1000:1000 \
  --read-only \
  --tmpfs /tmp \
  --tmpfs /etc/chromium \
  -p 3000:3000 \
  flowiseai/flowise:3.1.3