Flowise: FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Critical, CVSS 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Record
- CVE-2026-46442
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 8, 2026
- Source last modified
- July 23, 2026
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is not configured — the common deployment case — Flowise executes this code inside a NodeVM sandbox. This sandbox can be escaped, allowing an attacker to reach the host process object and execute system commands via child_process. The result is authenticated remote code execution on the Flowise server host. This issue has been patched in version 3.1.2.
Description quoted from the NVD record.
Who is affected
This flaw affects Flowise, a drag-and-drop tool for building apps that use AI language models, in all versions before 3.1.2. Any signed-in user, or anyone holding an access key for the product, can send their own JavaScript code to the building block that runs custom code in a flow. In the common setup, where Flowise is not connected to a separate outside service for running code, that code runs in a protective sandbox that can be broken out of. An attacker could then run system commands on the server that hosts Flowise. This flaw is rated Critical.
What to do
- If your organization installed Flowise and runs it on its own server, the person who set it up or looks after it should handle this.
- That person should update Flowise to version
3.1.2or later, which fixes this flaw. After updating, they should check that the version shown is3.1.2or newer. - If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update to
3.1.2will be done. - If you are not sure whether your organization uses Flowise, ask whoever looks after your computers and servers to find out.
Analysis written from the source record as of July 23, 2026 and reviewed before publishing.