# Flowise: a custom function escapes the sandbox and runs OS commands

> Flowise through 3.1.4 lets a logged-in user break out of the custom function sandbox and run commands on the server.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-30
- **CVE:** CVE-2026-119978
- **CVSS:** 9
- **Affects:** Flowise
- **Research by:** soovwv
- **Primary source:** https://www.vulncheck.com/advisories/flowise-through-3.1.4-custom-function-sandbox-escape-rce-via-localfilestore
- **Page:** https://theinjection.dev/items/vulncheck-flowise-custom-function-sandbox-escape/

Flowise through 3.1.4 lets an authenticated user escape the vm2 sandbox and run OS commands, by writing a file into the allowlisted mammoth package and requiring it. Exploitation needs ALLOW_BUILTIN_DEP set to true, and no fix is listed.

## What happened

VulnCheck published CVE-2026-119978 on October 30, 2026, crediting the reporter soovwv. The advisory covers Flowise releases up to and including 3.1.4 and lists no fixed version. It follows an earlier escape in the same custom function feature, CVE-2026-73483, which Flowise fixed in 3.1.3.

## How it works

The escape abuses two modules Flowise allowlists, langchain and mammoth. An authenticated caller submits JavaScript to the /api/v1/node-custom-function endpoint that uses LocalFileStore to write a file into the mammoth package directory, then requires that file. Loading attacker-written code through an allowlisted module takes execution outside the vm2 sandbox, where commands run as the Flowise process user.

## Who is affected

Flowise deployments on 3.1.4 or earlier are exposed when ALLOW_BUILTIN_DEP is set to true and an attacker holds an account that can reach the custom function endpoint. VulnCheck does not say what that setting defaults to, and names no release that resolves the flaw.

## What to do

Check whether ALLOW_BUILTIN_DEP is enabled on your Flowise instances and turn it off where the built-in dependency feature is not needed, since the advisory makes that setting a precondition. Limit which accounts can reach /api/v1/node-custom-function while no fixed release is listed.

## Quick facts

- **Affected:** Flowise <= 3.1.4, per VulnCheck
- **Fixed in:** No fixed version listed
- **Preconditions:** An authenticated account reaching /api/v1/node-custom-function, and ALLOW_BUILTIN_DEP=true
- **CVE:** CVE-2026-119978
- **CVSS:** 9.0 CVSS 4.0, and 8.5 CVSS 3.1, both published by VulnCheck
- **Earlier escape:** CVE-2026-73483 abused puppeteer.launch and was fixed in 3.1.3
- **Found by:** soovwv, per VulnCheck

## Sources

1. [VulnCheck Advisory](https://www.vulncheck.com/advisories/flowise-through-3.1.4-custom-function-sandbox-escape-rce-via-localfilestore)
2. [Earlier Flowise Escape](https://github.com/advisories/GHSA-9gvv-qjj3-2p6g)
3. [Vulnerable Code](https://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c95/packages/components/src/utils.ts)