Cruising for Shells in Flowise - elttam

Skip to main content

Important Update Banner<br>Close Announcement Banner

By

Luke Jahnke<br>and<br>Alex & Jia

August 3, 2026

Cruising for Shells in Flowise<br>6 RCEs That Rode Flowise Low and Slow

web

flowise

On This Page

TOC Element

Share:

Introduction<br>With the plethora of LLMs and AI products available today, it is not uncommon for developers to be subscribed to multiple services at once. Although these services can be very powerful individually, stringing them together into a single, coherent workflow is often anything but straightforward. So it came as no surprise to us that Flowise has become one of the top GitHub repositories in this space.<br>Flowise advertises itself as a "generative AI development platform for building AI Agents and LLM workflows".It offers a self-hosted option, as well as a cloud/enterprise plan where users can pay for support and additional enterprise features such as multiple workspaces.<br>Past Vulnerabilities<br>Imagine our surprise when we navigated to Flowise's security advisories on GitHub and saw that it was full of high and critical vulnerabilities.<br>As we reviewed these advisories, our curiosity was piqued even further, and we decided to spend some time reviewing the codebase as well.<br>Most of the patched issues were of high or critical severity, and the technical details behind them were alarming.<br>For example, CVE-2025-58434 described how the password reset flow allowed account takeovers.This was due to its original implementation sending the password reset token in the response when requesting a password reset token for an email address of a registered user.

curl -i -X POST https:///api/v1/account/forgot-password \<br>-H "Content-Type: application/json" \<br>-d '{"user":{"email":""}}'

"user": {<br>"id": "",<br>"name": "",<br>"email": "",<br>"credential": "",<br>"tempToken": "",<br>"tokenExpiry": "2025-08-19T13:00:33.834Z",<br>"status": "active"

Then there are also multiple instances where user input was executed as pure JavaScript, as seen in: CVE-2025-59434, CVE-2025-59528, GHSA-7944-7c6r-55vv, and many more.<br>There were also account-related issues, which can be used as part of an exploit chain. For example, the password change feature did not require the user to re-enter their password.The email change feature also had a similar issue.<br>Flowise's custom Model Context Protocol (MCP) node has also been associated with multiple prior Remote Code Execution (RCE) vulnerabilities, including CVE-2026-40933, CVE-2026-41268, CVE-2025-59528, and GHSA-6933-jpx5-q87q. These issues reflect a broader, systemic problem across the AI industry involving the insecure use of stdio MCP servers, as discussed in this analysis.<br>Discovered Vulnerabilities<br>Having reviewed all the low-hanging fruit covered thus far, we were determined to sweep the codebase for further vulnerabilities, with a particular focus on identifying Remote Code Execution (RCE) issues. After diving into this massive codebase, we were able to identify 6 more ways to achieve RCE in Flowise v3.1.1 and v3.1.2 .<br>As we were writing up this post after having our submissions accepted, Flowise published a batch of vulnerabilities that were reported by ZDI and other researchers. These were vulnerabilities that affected versions prior to 3.1.0. Interestingly, CVE-2026-41264 was an RCE vulnerability in the CSVAgent node, which was what we reported as well. This meant that the patch was insufficient, and we were able to find additional vectors to exploit the issue in the patched version.<br>CVE-2025-26319 describes a sandbox escape vulnerability regarding the use of Flowise's nodevm, a fork of the insecure vm2 sandbox, that was achieved by abusing the puppeteer and playwright modules that were permitted within the sandbox. Flowise's remediation restricted allowed external modules to node-fetch, axios, and moment by default. However, we were able to bypass the sandbox again by exploiting the moment vulnerability CVE-2022-24785, as its patch is insufficient within a sandboxed execution context.<br>CVE-2026-41268 exploited the configuration of a Flowise Custom MCP node to inject a NODE_OPTIONS environment variable for a spawned node process. A part of Flowise's patch was to include NODE_OPTIONS in a denylist validation check, but from our previous research into hacking with environment variables we knew this validation check was not sufficient, and we were able to exploit the same node to achieve RCE again.<br>The other three RCE vulnerabilities we reported were novel and did not have previously documented variants. We identified multiple instances where Flowise permitted users to supply arbitrary options when initialising the TypeORM DataSource class, enabling exploitation of parameters such as entities to load and execute arbitrary JavaScript code. The SQL Database Chain and SQLite Record Manager nodes also allowed users to write a SQLite database to an arbitrary file path. We exploited this capability to create a polyglot shell script...