GHSA-9gvv-qjj3-2p6g: Npm/flowise-components vulnerability
Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes childprocess.spawn() outside the sandbox boundary. This allows execution of arbitrary OS commands as the Flowise process user (root in the official Docker image) and arbitrary host file disclosure via Chromium's file:// URL handling. In versions 3.0.8–3.1.2 exploitation requires ALLOWBUILTINDEP=true; earlier versions are exploitable by default. Fixed in 3.1.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/flowise-componentsto a version that resolves this vulnerability.Fixed in 3.1.3 - Upgrade
Upgrade
npm/flowiseto a version that resolves this vulnerability.Fixed in 3.1.3 - Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 3.1.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can access the /api/v1/node-custom-function endpoint can exploit it. Successful exploitation allows commands to run as the Flowise process user, which is root in the official Docker image.
Are default deployments affected?
Versions earlier than 3.0.8 are exploitable by default. In versions 3.0.8 through 3.1.2, exploitation additionally requires ALLOW_BUILTIN_DEP=true.
What can an attacker do after exploiting the sandbox escape?
An attacker can execute arbitrary operating-system commands as the Flowise process user. They can also disclose arbitrary host files through Chromium file:// URL handling.
What is the available fix?
Upgrade both flowise and flowise-components to version 3.1.3 or later. Versions up to and including 3.1.2 are affected.
What can be done if upgrading is not immediately possible?
For versions 3.0.8 through 3.1.2, ensure ALLOW_BUILTIN_DEP is not set to true. Restrict access to the /api/v1/node-custom-function endpoint to prevent authenticated users from reaching the vulnerable functionality.