CVE-2026-69253: Flowise Sandbox Escape to RCE
============================================================================= Security Advisory elttam
Topic: Flowise JavaScript Sandbox Escape
Module: FlowiseAI/Flowise, FlowiseAI/nodevm
Disclosed: 11-Apr-2026
Credits: Luke Jahnke and Alex Brown
Affects: FlowiseAI/Flowise 3.1.1, FlowiseAI/nodevm 3.9.25
References
- github.com/FlowiseAI/Flowise/commit/3f257bdc8196082a178da7134a075824401b13b9
- github.com/FlowiseAI/Flowise/pull/6417
- github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3
- github.com/FlowiseAI/Flowise/security/advisories/GHSA-wg86-r78f-74mp
- github.com/advisories/GHSA-wg86-r78f-74mp
- nvd.nist.gov/vuln/detail/CVE-2026-69253
Code Behaviors & Features
Detect and mitigate CVE-2026-69253 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →