Which versions of Flowise are affected by EUVD-2026-35110?

FlowiseAI Flowise (versions prior to 3.1.2) permits any authenticated user to execute arbitrary code on the server, enabling complete system compromise.. A patch is available.

How to fix or mitigate EUVD-2026-35110?

Within 24 hours: Audit all deployed instances of Flowise and identify users with active sessions or API keys. Within 7 days: Apply vendor-released patch to upgrade all Flowise installations to version 3.1.2 or later. Within 30 days: Review access logs for suspicious activity, rotate all API keys and session tokens, and implement enhanced monitoring on Flowise application endpoints.

Flowise EUVD-2026-35110

Q: What is the CVSS score of EUVD-2026-35110?

EUVD-2026-35110 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-46442 CRITICAL

Code Injection (CWE-94)

2026-06-08 GitHub_M

GHSA-9rvc-vf7m-pgm2

Code Injection RCE Flowise

9.4

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 18:18 vuln.today

Analysis Generated

Jun 08, 2026 - 18:18 vuln.today

Patch available

Jun 08, 2026 - 17:01 EUVD

CVSS changed

Jun 08, 2026 - 16:22 NVD

9.4 (CRITICAL)

CVE Published

Jun 08, 2026 - 15:30 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is not configured - the common deployment case - Flowise executes this code inside a NodeVM sandbox. This sandbox can be escaped, allowing an attacker to reach the host process object and execute system commands via child_process. The result is authenticated remote code execution on the Flowise server host. This issue has been patched in version 3.1.2.

AnalysisAI

Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key to submit arbitrary JavaScript via POST /api/v1/node-custom-function, which executes inside a NodeVM sandbox that can be escaped to reach the host process and spawn child processes. CVSS 4.0 scores this 9.4 Critical, and publicly available exploit details exist via the GHSA advisory, though no public exploit identified at time of analysis in CISA KEV. The flaw stems from missing route-level authorization combined with a sandbox that Flowise itself documents as a security boundary but which fails to contain malicious payloads.

Technical ContextAI

Flowise is a Node.js-based low-code platform for building LLM workflows. The vulnerability sits at the intersection of two defects mapped to CWE-94 (Improper Control of Generation of Code): the /api/v1/node-custom-function route in packages/server/src/routes/node-custom-functions/index.ts is registered without the checkAnyPermission middleware used on peer routes like chatflows, so global /api/v1 authentication is the only gate. User-supplied javascriptFunction is forwarded through executeCustomNodeFunction into createCodeExecutionSandbox, which only routes to the external E2B sandbox when E2B_APIKEY is set; otherwise it falls back to @flowiseai/nodevm with eval:false and wasm:false. NodeVM is a userland JavaScript isolation library, not a kernel-level sandbox, and well-known prototype/constructor traversal techniques allow escaping to the host process object and invoking require('child_process'). Affected CPE is cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: 3.1.2. Upgrade to flowise 3.1.2 or later via https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2, which adds route-level authorization to /api/v1/node-custom-function and ships alongside several other security fixes in the same release. If immediate upgrade is not possible, configure E2B_APIKEY to force code execution through the external E2B sandbox instead of the in-process NodeVM fallback (trade-off: requires an E2B account and outbound network egress, and does not address the missing authorization itself); additionally restrict network access to the Flowise API to trusted operators only and rotate any API keys held by lower-trust users, since PR:L means any valid credential reaches the sink. As a stronger compensating control, place a reverse proxy in front of Flowise that blocks POST /api/v1/node-custom-function except from administrator source IPs (trade-off: breaks legitimate custom-function authoring for non-admin users). Consult the advisory at https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9rvc-vf7m-pgm2 for full details.