Six newly disclosed vulnerabilities in Flowise, a preferred open‑supply platform for constructing AI brokers and LLM workflows, permit unauthenticated and low‑privileged attackers to realize distant code execution (RCE) on self‑hosted and cloud AI workflow servers operating weak variations.
These flaws collectively expose organizations to full server compromise, information exfiltration, and AI pipeline manipulation if cases are usually not promptly upgraded and locked down.
Nonetheless, its GitHub safety advisories already confirmed a historical past of excessive and significant points, together with account takeover by way of an insecure password reset circulation (CVE‑2025‑58434) and a number of cases of consumer‑provided enter being executed as uncooked JavaScript (CVE‑2025‑59434, CVE‑2025‑59528, GHSA‑7944‑7c6r‑55vv).
Flowise’s {custom} Mannequin Context Protocol (MCP) node has additionally been linked to prior RCE points comparable to CVE‑2026‑40933, CVE‑2026‑41268, CVE‑2025‑59528 and GHSA‑6933‑jpx5‑q87q, highlighting a systemic sample of unsafe sandboxing in AI tooling.
Researchers reviewing the Flowise 3.1.1 and three.1.2 codebase recognized six extra RCE vectors, a number of of which bypassed present patches or reused insecure design patterns.
Notably, one of many new bugs overlapped with CVE‑2026‑41264, an RCE within the CSVAgent node that Flowise had already patched in earlier variations, proving that the unique remediation was incomplete and remained exploitable in later builds.
The brand new flaws span Python, JavaScript and setting‑variable abuse, and in lots of instances require nothing greater than consumer‑managed configuration fields that have been assumed protected in regular workflow building.
One of the vital vital findings is a server‑aspect Python execution path by way of the CSVAgent node, which makes use of Pyodide to run consumer‑provided pandas code meant for CSV preprocessing.
Whereas Flowise tried to guard this function with a denylist‑primarily based validator and a requirement that code begin with a single readcsv name, the researchers confirmed a number of methods to bypass these controls, together with exploiting pandas’ readpickle to deserialize a malicious payload and utilizing pandas.io.widespread.
In a sensible exploit, an attacker might construct a base64‑encoded pickle payload that launches a reverse shell (e.g., by way of nc) and ship it by way of the CSVAgent “Further Parameters” area, then set off the chatflow by way of the prediction API to achieve full RCE on the Flowise server.
One other class of RCE arises from Flowise’s fork of the deprecated vm2 sandbox, used to execute “Customized Perform” JavaScript by way of the /api/v1/node-custom-function endpoint.
Elttam Researchers mentioned that, Flowise has quickly grown right into a high GitHub venture for assembling AI workflows, providing each self‑hosted deployments and a industrial cloud/enterprise tier with multi‑workspace assist.
Six Flowise Vulnerabilities
Though Flowise restricted the sandbox to sure modules, it explicitly allowed axios, second and node‑fetch, and was operating a vm2 construct nonetheless weak to CVE‑2026‑22709, enabling a direct sandbox escape utilizing crafted Error stack abuse and child_process.execSync.
Even after Flowise tried to harden the sandbox and later disabled vm2 by default, the researchers demonstrated a brand new escape by abusing second’s CVE‑2022‑24785 path traversal habits contained in the sandbox, mixed with the Flowise doc retailer uploader to write a JavaScript payload (rce.js) into .flowise/storage after which load and execute it by way of second.
Comply with‑up work confirmed that vm2 remained reachable even when nominally disabled, by way of nodes comparable to AgentAsTool, ChatflowTool and ExecuteFlow that invoked executeJavaScriptCode with useSandbox=false.
In these nodes, a baseURL parameter handed solely a superficial isValidURL test that ignored the URL fragment, permitting attackers to inject arbitrary JavaScript into the sandboxed code by appending payloads within the hash portion.
This system confirmed that the second‑primarily based sandbox escape continued in a later Flowise commit, undermining the preliminary assumption that merely updating vm2 would neutralize the difficulty.
The sixth main RCE vector targets Flowise’s {custom} MCP node, which integrates exterior Mannequin Context Protocol servers by way of the modelcontextprotocolsdk and, by default, permits the unsafe stdio transport when CUSTOMMCPPROTOCOL=stdio.
Flowise tried to defend towards native file and setting abuse with checks that prohibit instructions to node, npx, python, python3 and docker and denylist just a few harmful setting variables comparable to PATH and NODEOPTIONS, however left different highly effective variables untouched.
By leveraging strategies from prior setting variable exploitation analysis, together with joern’s PYTHONWARNINGS/BROWSER trick.
The researchers achieved RCE by way of python3 MCP servers and likewise through the use of node with args pointing to /proc/self/environ whereas overriding HOME in order that the setting file turns into legitimate JavaScript containing a reverse shell payload.
Flowise addressed parts of those points in a number of pull requests, together with eradicating the CSVAgent and AirtableAgent nodes on account of NFKC normalization issues, dropping second from allowed vm2 dependencies, and including an setting variable allowlist plus altering the default MCP transport from stdio to SSE.
Nonetheless, the researchers stress that counting on vm2 stays harmful given its historical past of contemporary escape strategies, and suggest migrating to remoted‑vm or a stronger isolation primitive, particularly for multitenant AI workflow deployments.
Directors ought to instantly improve Flowise to the most recent safe model, audit deployments for uncovered prediction and node‑{custom}‑perform endpoints, disable or lock down {custom} Python/JS execution nodes, and keep away from enabling CUSTOMMCPPROTOCOL=stdio until completely required and constrained by strict community and host hardening.
$1M Knowledge Breach Guarantee is Real Safety?: Obtain 10 Level Free AI SOC Breach Guarantee Information
