CVE-2026-69253
Received Received - Intake

Code Injection in Flowise Prior to 3.1.3

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process  vm2  sandbox. To build that code, they inserted a user-controlled  baseURL  value straight into the JavaScript source, for example  const url = "${baseURL}/..."; . The only check on  baseURL  was  isValidURL , but a valid-looking URL can still contain characters that break out of a code string. An authenticated user could craft a  baseURL  that passed this check, closed the surrounding string, and injected their own JavaScript into the sandboxed script (code injection, CWE-94). The  vm2  sandbox runs in the same Node.js process as Flowise and exposes risky dependencies. As a result, the injected code could escape the sandbox and run arbitrary code on the Flowise server as the Flowise process user. Exploitation only requires an authenticated session. The issue is fixed in version 3.1.3, which passes the URL to the sandbox as data instead of inserting it into code and adds stricter URL validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-69253
EUVD
EUVD-2026-52739

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
flowise flowise to 3.1.3 (exc)
flowiseai flowise 3.1.3
flowiseai nodevm 3.9.25

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a code injection flaw in Flowise versions before 3.1.3. It involves three custom-tool components (AgentAsTool, ChatflowTool, ExecuteFlow) that improperly handled user-controlled baseURL values. These values were inserted directly into JavaScript code strings, allowing authenticated users to inject malicious JavaScript that could escape the vm2 sandbox and execute arbitrary code on the server.

Detection Guidance

Check Flowise version with 'npm list flowise' or 'docker inspect <container>'. Vulnerable versions are 3.1.1 and earlier. Inspect network logs for unusual outbound connections or unexpected JavaScript file uploads. Monitor for sandbox escape attempts in application logs.

Impact Analysis

An attacker with an authenticated session could exploit this to run arbitrary commands on your Flowise server. This could lead to complete system compromise, data theft, or unauthorized access to sensitive information. The impact depends on the server's permissions and the data it handles.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Flowise to version 3.1.3 or later immediately. Disable or restrict authenticated user access until patched. Review and validate all baseURL inputs in AgentAsTool, ChatflowTool, and ExecuteFlow components. Block unsafe protocols (file, javascript, ftp) in URL validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69253. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart