Improper access control in Flowise - #VU140052
Published: July 30, 2026
Vulnerability identifier: #VU140052
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper access control in the NodeVM sandbox allowlist and /api/v1/node-custom-function endpoint when processing authenticated user-supplied JavaScript that loads puppeteer. A remote user can submit crafted JavaScript that invokes puppeteer's launch() API with attacker-controlled executablePath and arguments to execute arbitrary code.
The code runs as the Flowise process user, which is root in the official Docker image.
Affected software
Flowise
Remediation
Install security update from vendor's website.
Flowise - update to 3.1.3