Verified

ghsa:GHSA-6J9G-8FXC-25HQ: flowise <= 3.1.2; +1 more affected products

Duplicate Advisory: Flowise contains an unauthenticated sandbox escape. Affected range: <= 3.1.2. Fixed version: 3.1.3. Affected range: <= 3.1.2. Fixed version: 3.1.3.

Affected technology

flowise · <= 3.1.2
Vendor not specified by the source

flowise-components · <= 3.1.2
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated user with access to the `/api/v1/node-custom-function` endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. Source advisory’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as high.

Published 13-Oct-2026 07:27 UTC

Product: flowise
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-08 08:50:52.119177+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-6j9g-8fxc-25hq.html