CVE-2026-46442

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.2

Description Flowise is a drag-and-drop user interface for building customized large language model flows. The endpoint 'POST /api/v1/node-custom-function' lacks route-level authorization, which allows any authenticated user or holder of a valid API key to submit arbitrary JavaScript to the Custom JS Function node. In deployments where E2B APIKEY is not configured, the software executes this code within a NodeVM sandbox. This sandbox can be escaped by abusing an exception path where an Error object allows recovery of the host Function constructor, enabling access to the host process object and the execution of system commands via child process. This leads to authenticated remote code execution on the server host, potentially allowing attackers to read secrets, access the filesystem, or perform lateral movement. Real-world attempts to exploit this issue have been observed.

Recommendations Update Flowise to version 3.1.2. As a temporary mitigation, configure the E2B APIKEY to avoid the vulnerable NodeVM fallback. Restrict access to the 'POST /api/v1/node-custom-function' endpoint to minimize the risk of exploitation.