CVE-2026-69253

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description An authenticated user can achieve remote code execution on the Flowise server by escaping the vm2 sandbox. The issue exists in the AgentAsTool, ChatflowTool, and ExecuteFlow custom-tool components, which execute code within an in-process vm2 sandbox. These components improperly validate the baseURL variable using the isValidURL function, which fails to account for characters in the URL hash fragment. An attacker can craft a malicious baseURL to break out of the JavaScript string and inject arbitrary code. Because the vm2 sandbox runs in the same Node.js process as Flowise and has access to risky dependencies, the injected code can escape the sandbox and execute commands as the Flowise process user.

Recommendations Update Flowise to version 3.1.3 or later. As a temporary mitigation, restrict the use of the AgentAsTool, ChatflowTool, and ExecuteFlow components.