EUVD-2026-57806
GHSA-56h4-p63w-w4wm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-privilege authenticated user (PR:L) escapes the sandbox, so scope changes (S:C) with full host C/I/A impact; payload crafting is deterministic, keeping AC:L.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to load and execute malicious JavaScript files stored in the document store outside the sandbox.
AnalysisAI
Remote code execution in Flowise before 3.1.3 lets authenticated users escape the vm2 JavaScript sandbox and run arbitrary code on the host. By abusing a moment.js locale-validation weakness, an attacker supplies a forged String object whose match function defeats the path-traversal check, causing Flowise to load and execute an attacker-planted JavaScript file from the document store outside the sandbox. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Flowise account (PR:L) with the ability to reach the vulnerable feature over the network and to place a file into the document store; the attacker must craft a fake String object exposing a malicious match function to defeat the path-traversal validation and abuse the moment locale-validation bypass. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority rather than a paper-high score: the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) with H across all vulnerable- and subsequent-system impact metrics describes network-reachable, low-complexity code execution that only requires a low-privileged authenticated account, and a sandbox escape inherently crosses a trust boundary (subsequent-system impact H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A user with a low-privileged Flowise account uploads or plants a malicious JavaScript file in the document store, then triggers a workflow that invokes the vulnerable code path with a crafted fake String object whose match function bypasses the path-traversal check. Flowise resolves the path outside the vm2 sandbox and executes the file as the host Node.js process, giving the attacker code execution on the server. … |
| Remediation | Vendor-released patch: upgrade Flowise to 3.1.3 or later, which is the primary and authoritative fix (see advisory GHSA-rqh4-rxw3-93rp and fix commit 4211bfc8f15746be4019bba557e29a7ba83d54c5). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Flowise instances in your environment and determine which versions are deployed (vulnerability affects versions before 3.1.3); immediately restrict network access to essential users and review authentication logs from the past 30 days for suspicious activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Privilege escalation in Flowise versions prior to 3.0.13 allows authenticated users to bypass API authorization by spoof
Flowise versions up to 3.0.13 is affected by authorization bypass through user-controlled key (CVSS 8.8).
Same weakness CWE-95 – Eval Injection
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today