JavaScript sandbox escape leading to RCE in Flowise (CVE-2026-69253)

An authenticated attacker can escape the vm2 JavaScript sandbox used by Flowise's AgentAsTool, ChatflowTool, and ExecuteFlow nodes by injecting arbitrary code through an unsanitized baseURL parameter, which is interpolated directly into dynamically constructed JavaScript executed without sandbox isolation. Combined with a path traversal bypass of the CVE-2022-24785 patch via a crafted String object overriding the match method, this chain achieves remote code execution on the host running Flowise. Affected versions: - flowise <= 3.1.2 - flowise-components <= 3.1.2 We recommend updating to: flowise 3.1.3, flowise-components 3.1.3. CVSS 9.0 · our assessment: act_now Reference: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wg86-r78f-74mp Details: https://vuln.today/cve/CVE-2026-69253