Flowise CVE-2025-34267

Requires an authenticated Flowise account with privileges to create or run a Custom Tool/Function (CVSS PR:H), and the account must be able to invoke the integrated Puppeteer or Playwright modules from within the nodevm execution environment. On versions 3.0.1 through pre-3.0.8 this path is reachable by default; on 3.0.8 and later it is only exploitable when the operator has explicitly set ALLOW_BUILTIN_DEP=true, since the fix gates built-in/project dependency exposure behind that flag (default false). Exploitation is limited by that required privilege level and, on patched builds, by the non-default configuration toggle; no end-user interaction beyond the attacker's own tool execution is needed (UI:N).

The CVSS 4.0 base score of 8.4 (High) with vector AV:N/AC:L/AT:N/PR:H/UI:N and VC:H plus subsequent-system impact (SC:H/SI:H) reflects network reachability, low complexity, no user interaction, but a requirement for high privileges (PR:H) - i.e. an authenticated account with rights to create or run tools. That authentication requirement, combined with the non-default ALLOW_BUILTIN_DEP toggle needed for versions after the fix, materially limits mass exploitation despite the network attack vector. Publicly available exploit code exists, which raises practical risk for exposed or multi-tenant Flowise instances, but there is no CISA KEV listing and no EPSS score was provided in the input, so widespread automated exploitation is not evidenced - this reads as a targeted, post-authentication escalation-to-host risk rather than an internet-wide worming threat. Net priority is High for any organization running affected Flowise versions with untrusted or low-trust users who can author tools, and elevated where the instance is internet-exposed; lower where Flowise is single-tenant and access is tightly controlled.

An authenticated Flowise user with tool-creation rights builds a Custom Tool that invokes the bundled Puppeteer or Playwright API, pointing the browser executablePath at an attacker-chosen binary (or supplying malicious launch arguments). When the tool runs, Flowise spawns that executable on the host outside the nodevm sandbox, giving the attacker arbitrary command execution in the host context. Public exploit code exists, and given AC:L/UI:N the tool executes reliably once created by a privileged account.