Remote code execution in FlowiseAI Flowise via SQLite Record Manager Node (CVE-2026-69259)

The SQLite Record Manager node in Flowise accepts a user-controlled `additionalConfig` input whose contents are spread into the SQLite options object after the `database` property is set, allowing an authenticated attacker to overwrite the database path to an arbitrary filesystem location. By crafting a malicious SQLite database file with a command-substitution payload embedded in the `namespace` field and writing it to a Chromium configuration directory (e.g., `/etc/chromium/exploit.conf`), an attacker can trigger remote code execution when Puppeteer launches a Chromium browser that sources the file. Because the official Docker image runs as `root`, successful exploitation results in full compromise of the container. Affected versions: - flowise <= 3.1.2 - flowise-components <= 3.1.2 We recommend updating to: flowise 3.1.3, flowise-components 3.1.3. CVSS ? · our assessment: act_now Reference: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x3hf-7cj6-3r4m Details: https://vuln.today/cve/CVE-2026-69259