CVE-2026-69259

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description An authenticated attacker can achieve remote code execution (RCE) through the SQLite Record Manager node. The issue occurs because the additionalConfig input is spread after the intended database setting in the init() function, allowing the additionalConfig.database variable to overwrite the default SQLite database path.

When using the published Docker image that runs as root, an attacker can write a SQLite database to arbitrary system paths, such as /etc/chromium/exploit.conf. By manipulating the tableName and namespace variables, the attacker can inject shell syntax into the database file. This payload is triggered when Puppeteer launches Chromium and sources configuration files from /etc/chromium/*.conf, leading to full system compromise.

Recommendations Update to version 3.1.3. As a mitigation measure, use a low-privileged user for container runtimes instead of the root user to restrict filesystem access. Ensure that the additionalConfig input cannot be used to overwrite the database property to an arbitrary file path.