CVE-2026-69254: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
A sandbox escape vulnerability in executeJavaScriptCode() allows any authenticated user to execute arbitrary system commands as root on the Flowise server. The function accepts caller-provided nodeVMOptions that override the
default sandbox security settings via JavaScript’s spread operator, allowing an attacker to re-enable blocked modules like child_process and fs.
References
- github.com/FlowiseAI/Flowise/commit/3086cb7e323bb96c5a581d3232ef975b0d92183d
- github.com/FlowiseAI/Flowise/pull/6306
- github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3
- github.com/FlowiseAI/Flowise/security/advisories/GHSA-3769-jgqc-cxm7
- github.com/advisories/GHSA-3769-jgqc-cxm7
- nvd.nist.gov/vuln/detail/CVE-2026-69254
Code Behaviors & Features
Detect and mitigate CVE-2026-69254 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →