CVE-2026-69254

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description A sandbox escape exists in the executeJavaScriptCode() function that allows an authenticated attacker to execute arbitrary system commands as root on the server. The issue occurs because the function accepts caller-provided nodeVMOptions and merges them over the default security settings using the spread operator, allowing the override of restricted modules. An attacker can reach the packages/server/src/routes/node-custom-functions/index.ts endpoint and provide a custom function that re-enables built-in modules by setting nodeVMOptions.require.builtin to allow all modules. This enables the use of the child process module to run system commands. This flaw allows full remote code execution, enabling the attacker to read sensitive files such as encryption keys and JWT signing secrets.

Recommendations Update Flowise to version 3.1.3 or later. As a temporary mitigation, restrict access to the packages/server/src/routes/node-custom-functions/index.ts endpoint to minimize the risk of exploitation.