Flowise Fixes Critical Root RCE Vulnerability

A critical remote code execution vulnerability tracked as CVE-2026-69255 and GHSA-vmv7-4m6c-3cg5 has been identified in Flowise. The flaw allows authenticated users with low privileges to bypass runtime restrictions and execute arbitrary operating system commands as root on the host machine. Development maintainers have released version 3.1.3 to remediate the vulnerability across affected component packages.

What's at Risk

The security flaw impacts the npm/flowise and npm/flowise-components packages in versions prior to 3.1.3, with successful remote code execution verified on version 3.1.2. Because Flowise is an open-source UI tool commonly deployed to build and orchestrate customized AI workflows, vulnerable instances are frequently exposed on cloud servers or embedded within broader enterprise application environments.

Exploitation of this vulnerability yields total system compromise. Technical verification confirmed that attackers can establish a Meterpreter reverse shell operating with full administrative root privileges inside the application container. In addition to executing arbitrary system commands, an attacker can extract plaintext application secrets—including internal database paths, stored API keys, and administrative credentials such as FLOWISE_PASSWORD. Attackers can also perform arbitrary file reads across the filesystem or trigger server denial-of-service conditions by issuing native binding calls that crash the underlying Node.js process.

How the Flaw Works

Code injection flaws occur when untrusted user input is passed directly into an execution context without proper sanitization, escaping, or structural isolation. In this vulnerability, the flaw originates within the CSV Agent component file CSVAgent.ts, where string formatting incorporates user input into a base64 string variable passed to the Pyodide Python execution environment. Although the application attempts to restrict payload inputs—such as splitting input strings on commas—attackers can craft comma-free injection payloads that execute within Pyodide.

Multi-language runtime bridges often introduce subtle security risks. Here, Pyodide's JavaScript bridge provides embedded Python scripts with indirect access to the global host environment. By leveraging JavaScript evaluation functions through the bridge, an attacker can reference internal Node.js constructors to load native core modules like child_process, effectively bypassing ECMAScript module import restrictions. Because the application process runs as process ID 1 under the root account inside default container setups, invoked system commands execute with unrestricted root authority on the host OS.

How to Protect Your Systems

• Upgrade Flowise packages immediately: Update both npm/flowise and npm/flowise-components to version 3.1.3 or later.
• Run containers as non-root: Modify container specifications and Dockerfiles to execute the Flowise Node.js process under a dedicated, unprivileged non-root user account.
• Restrict network exposure: Ensure Flowise management interfaces are placed behind network firewalls, corporate VPNs, or access-controlled reverse proxies rather than directly exposed to the public internet.
• Rotate sensitive credentials: Change all API keys, database paths, and environment passwords managed within the application, as an exploited instance exposes these secrets to unauthorized readers.
• Monitor process activity: Implement host-based monitoring to detect anomalous child processes spawned by Node.js binaries or unexpected outbound TCP connections.

Carrying a maximum CVSS v3.1 severity rating of 9.9, this vulnerability presents an immediate danger to vulnerable deployments. Given the public availability of functional exploit chains and verified root compromise demonstrations, system administrators should apply the 3.1.3 patch and enforce container hardening measures immediately.