Flowise EUVD-2026-35110

Requires (1) network reachability to the Flowise HTTP API, (2) any valid authentication artifact - a logged-in session or API key at any privilege level, since the /api/v1/node-custom-function route has no per-permission middleware behind the global /api/v1 auth gate, and (3) the target instance running without E2B_APIKEY set in its environment, which the vendor describes as the common deployment case and causes Flowise to fall back to the in-process @flowiseai/nodevm sandbox. No user interaction, no admin role, and no non-default toggle are needed beyond the absence of E2B_APIKEY. Exploitation is LIMITED on instances where E2B_APIKEY is configured (code runs in the external E2B sandbox instead) and on instances where the Flowise API is not exposed to untrusted networks or where API key/account issuance is tightly controlled.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H yields 9.4 Critical, reflecting network reach, low complexity, low (not none) privileges, no user interaction, and high impact on both vulnerable and subsequent systems. PR:L is the only meaningful brake - an attacker needs any valid session or API key, which in many Flowise deployments includes self-registered users, shared API keys, or compromised low-privilege accounts, making this effectively low-friction once a foothold exists. EPSS data was not provided and the CVE is not on the CISA KEV list, so no public exploit identified at time of analysis for in-the-wild use; however, the GHSA advisory publicly describes the call chain and the NodeVM escape pattern is widely known, so weaponization should be assumed imminent. The vendor explicitly frames NodeVM as a declared security boundary, so this is a genuine RCE in the common (non-E2B) deployment configuration rather than a low-real-risk high-CVSS issue.

An attacker obtains any valid Flowise session cookie or API key - for example via a low-privilege account on a multi-tenant instance, a leaked key in a repository, or a phished collaborator - and sends a single POST to /api/v1/node-custom-function with a javascriptFunction body containing a known NodeVM constructor-traversal payload that pivots to the host process object and invokes child_process.exec. Within one request the attacker gains command execution as the Flowise service user, enabling credential theft from the .env file (LLM API keys, database creds), lateral movement, and persistence. The GHSA advisory publicly documents the full vulnerable call chain, lowering the bar for exploit development.