Flowise EUVD-2026-114243

Exploitation requires an authenticated account (PR:L) able to reach the /api/v1/node-custom-function endpoint AND the instance running with ALLOW_BUILTIN_DEP=true, which is a non-default configuration flag that enables the allowlisted langchain and mammoth modules the attack abuses. The concrete technique is to use LocalFileStore to write an attacker-controlled file into the mammoth package directory and then require() it, so it executes outside the vm2/@flowiseai/nodevm sandbox. Limiting factors: both the authenticated access and the ALLOW_BUILTIN_DEP=true setting must be present - without the flag the required built-in dependencies are not available; impact severity is heightened where the Flowise process runs as root (official Docker image per GHSA).

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) scores 9.0 with full vulnerable- and subsequent-system impact (VC/VI/VA/SC/SI/SA all High), consistent with a vm2 sandbox escape that yields OS command execution on the host. The AT:P ('attack requirements present') correctly encodes the non-default dependency: exploitation requires ALLOW_BUILTIN_DEP=true, and PR:L requires an authenticated account with access to /api/v1/node-custom-function. vuln.today assigns a Decision label of act_now and the issue was reported by VulnCheck, so urgency should be treated as high. However, the escalating signals are incomplete and partly conflicting: no CISA KEV listing is present, no EPSS probability is supplied, and the input does not label any reference as a confirmed working exploit - so there is no evidence of widespread active exploitation, and act_now appears driven by severity plus a credible vendor report rather than observed in-the-wild activity. Net assessment: this is a genuine high priority for anyone running Flowise with ALLOW_BUILTIN_DEP=true and any untrusted or multi-tenant authenticated users (impact is amplified because the official Docker image runs as root per the GHSA), but the dual precondition of authentication AND a non-default flag makes opportunistic mass exploitation less likely than the raw 9.0 implies - closer to a targeted risk than an internet-wide emergency.

An authenticated Flowise user on an instance configured with ALLOW_BUILTIN_DEP=true submits JavaScript to /api/v1/node-custom-function that uses the allowlisted langchain LocalFileStore to write an attacker-controlled file into the mammoth package directory, then require()s that module so it loads outside the vm2 sandbox, executing arbitrary OS commands as the Flowise process user (root in the official Docker image). No public exploit is identified in the supplied data, though the VulnCheck advisory documents the technique in detail. The low attack complexity (AC:L) and lack of required user interaction (UI:N) mean the request itself is straightforward once an account and the enabling flag are in place.