Flowise: a custom function escapes the sandbox and runs OS commands
Flowise through 3.1.4 lets a logged-in user break out of the custom function sandbox and run commands on the server.
· VulnCheck · Research by soovwv
Flowise through 3.1.4 lets an authenticated user escape the vm2 sandbox and run OS commands, by writing a file into the allowlisted mammoth package and requiring it. Exploitation needs ALLOW_BUILTIN_DEP set to true, and no fix is listed.
01What happened
VulnCheck published CVE-2026-119978 on October 30, 2026, crediting the reporter soovwv. The advisory covers Flowise releases up to and including 3.1.4 and lists no fixed version. It follows an earlier escape in the same custom function feature, CVE-2026-73483, which Flowise fixed in 3.1.3.
02How it works
The escape abuses two modules Flowise allowlists, langchain and mammoth. An authenticated caller submits JavaScript to the /api/v1/node-custom-function endpoint that uses LocalFileStore to write a file into the mammoth package directory, then requires that file. Loading attacker-written code through an allowlisted module takes execution outside the vm2 sandbox, where commands run as the Flowise process user.
03Who is affected
Flowise deployments on 3.1.4 or earlier are exposed when ALLOW_BUILTIN_DEP is set to true and an attacker holds an account that can reach the custom function endpoint. VulnCheck does not say what that setting defaults to, and names no release that resolves the flaw.
04What to do
Check whether ALLOW_BUILTIN_DEP is enabled on your Flowise instances and turn it off where the built-in dependency feature is not needed, since the advisory makes that setting a precondition. Limit which accounts can reach /api/v1/node-custom-function while no fixed release is listed.
Sources 3 links, all fetched
- 1vulncheck.comVulnCheck Advisory
- 2github.comEarlier Flowise Escape
- 3github.comVulnerable Code