Flowise EUVD-2026-57799

Exploitation requires an authenticated Flowise user (PR:L) with access to the /api/v1/node-custom-function endpoint who can supply a custom function referencing the bundled Puppeteer library and control the executablePath and args passed to puppeteer.launch(). On versions 3.0.8-3.1.2 the ALLOW_BUILTIN_DEP=true environment variable must be enabled (non-default), which limits exposure on those releases; versions earlier than 3.0.8 require no such setting and are exploitable by default. Impact is maximized on the official Docker image, where the process runs as root. Limiting factors: valid credentials/role granting custom-function access, and for recent versions the non-default ALLOW_BUILTIN_DEP flag; no user interaction is required.

The signals are strongly aligned toward high real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack needing only low-privilege authentication and no user interaction, with High vulnerable-system and subsequent-system impact across confidentiality, integrity, and availability (VC/VI/VA and SC/SI/SA all High), producing a 9.4 score consistent with full host compromise via sandbox escape. There is no KEV listing and no EPSS score in the provided data, so widespread active exploitation is not confirmed - treat this as no public exploit identified at time of analysis rather than exploited-in-the-wild. The one meaningful nuance is the PR:L requirement plus, for 3.0.8-3.1.2, the non-default ALLOW_BUILTIN_DEP=true gate; earlier versions are exploitable by default, which raises priority for older deployments. Given root execution in the official Docker image and a network vector, this is a genuine high priority for any internet- or multi-tenant-exposed Flowise instance, not a high-CVSS-but-low-impact artifact.

An attacker with a low-privilege authenticated Flowise account submits a custom function via /api/v1/node-custom-function that calls puppeteer.launch() with a chosen executablePath and args, causing child_process.spawn() to run an arbitrary binary as the Flowise (root) user. From there they execute OS commands to establish a foothold or read sensitive host files through Chromium's file:// handling. No public exploit is identified at time of analysis, but the low attack complexity and network vector make weaponization straightforward.