CVE-2025-34267: Flowise authenticated RCE

CISO Take

Flowise, a low-code AI agent builder, ships a nodevm sandbox meant to isolate tool execution, but authenticated users can bypass it entirely by pointing a Puppeteer or Playwright tool at an attacker-controlled browser binary path, resulting in arbitrary code execution on the host. This isn't a drive-by threat since it requires an authenticated account with tool-creation or tool-run privileges, but Flowise instances are frequently multi-tenant or team-shared, so "authenticated" often means "any onboarded low-privilege user or compromised credential." There's no CISA KEV listing, no public exploit, and no Nuclei template yet, and EPSS sits at 6.1% (still top 7% of all scored CVEs), so treat this as a real but not yet weaponized risk — CISA's own SSVC call is TRACK_STAR (monitor closely). The package itself has a poor track record (116 other CVEs in Flowise), which should raise your baseline distrust of any Flowise deployment exposed beyond a tightly controlled admin group. Patch to 3.0.8 or later immediately, and until then disable ALLOW_BUILTIN_DEP, since that flag is the precondition for this attack path.

Sources: NVD EPSS GitHub Advisory flowiseai.com ATLAS CISA KEV

What is the risk?

Moderate-to-high risk despite the authentication requirement: the impact is full host-level arbitrary code execution, which is the worst-case outcome for any sandboxed execution environment. Exploitability is non-trivial (attacker needs valid credentials plus tool-creation/run access and knowledge of nodevm/Puppeteer internals), which keeps sophistication at "moderate" rather than trivial. No active exploitation or public PoC lowers immediate urgency, but the CVE was previously misclassified as a duplicate of CVE-2025-26319, meaning some organizations may have already dismissed or deduplicated this finding incorrectly and remain unpatched. Flowise's broader CVE history (116 prior issues) suggests systemic hardening gaps rather than an isolated bug.

How does the attack unfold?

Initial Access

Attacker obtains or already holds an authenticated Flowise account with tool creation/run privileges.

AML.T0012

Tool Weaponization

Attacker configures a Puppeteer/Playwright-based tool node with an attacker-controlled browser executable path and launch parameters.

AML.T0011.002

Sandbox Escape

Attacker triggers the tool, causing the nodevm environment to launch the malicious binary/parameters outside the intended sandbox boundary.

AML.T0105

Impact

Arbitrary code executes in the context of the Flowise host process, giving the attacker full host compromise.

AML.T0050

Initial Access

Attacker obtains or already holds an authenticated Flowise account with tool creation/run privileges.

AML.T0012

Tool Weaponization

Attacker configures a Puppeteer/Playwright-based tool node with an attacker-controlled browser executable path and launch parameters.

AML.T0011.002

Sandbox Escape

Attacker triggers the tool, causing the nodevm environment to launch the malicious binary/parameters outside the intended sandbox boundary.

AML.T0105

Impact

Arbitrary code executes in the context of the Flowise host process, giving the attacker full host compromise.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

6.1%

chance of exploitation in 30 days

Higher than 93% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

Upgrade to Flowise 3.0.8 or later immediately. If upgrading isn't immediately possible, disable the ALLOW_BUILTIN_DEP environment variable to remove the vulnerable code path. Restrict tool-creation and tool-execution permissions to trusted administrators only — do not allow self-service tool building for general users in multi-tenant deployments. Audit existing tool configurations for suspicious Puppeteer/Playwright executablePath or launch-argument values pointing outside expected browser binary locations. Monitor host-level process execution originating from the Flowise service account for unexpected child processes, and apply egress restrictions on the host running Flowise to limit blast radius if RCE occurs.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Agent Plugin AML.T0011.002 - Poisoned AI Agent Tool AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0105 - Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.4 - AI System Security

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2025-34267?

Flowise, a low-code AI agent builder, ships a nodevm sandbox meant to isolate tool execution, but authenticated users can bypass it entirely by pointing a Puppeteer or Playwright tool at an attacker-controlled browser binary path, resulting in arbitrary code execution on the host. This isn't a drive-by threat since it requires an authenticated account with tool-creation or tool-run privileges, but Flowise instances are frequently multi-tenant or team-shared, so "authenticated" often means "any onboarded low-privilege user or compromised credential." There's no CISA KEV listing, no public exploit, and no Nuclei template yet, and EPSS sits at 6.1% (still top 7% of all scored CVEs), so treat this as a real but not yet weaponized risk — CISA's own SSVC call is TRACK_STAR (monitor closely). The package itself has a poor track record (116 other CVEs in Flowise), which should raise your baseline distrust of any Flowise deployment exposed beyond a tightly controlled admin group. Patch to 3.0.8 or later immediately, and until then disable ALLOW_BUILTIN_DEP, since that flag is the precondition for this attack path.

Is CVE-2025-34267 actively exploited?

No confirmed active exploitation of CVE-2025-34267 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-34267?

Upgrade to Flowise 3.0.8 or later immediately. If upgrading isn't immediately possible, disable the ALLOW_BUILTIN_DEP environment variable to remove the vulnerable code path. Restrict tool-creation and tool-execution permissions to trusted administrators only — do not allow self-service tool building for general users in multi-tenant deployments. Audit existing tool configurations for suspicious Puppeteer/Playwright executablePath or launch-argument values pointing outside expected browser binary locations. Monitor host-level process execution originating from the Flowise service account for unexpected child processes, and apply egress restrictions on the host running Flowise to limit blast radius if RCE occurs.

What systems are affected by CVE-2025-34267?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code AI orchestration, browser automation tooling.

What is the CVSS score for CVE-2025-34267?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworkslow-code AI orchestrationbrowser automation tooling

MITRE ATLAS Techniques

AML.T0011.002 Poisoned AI Agent Tool

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0105 Escape to Host

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execution environment. An authenticated attacker able to create or run a tool that leverages Puppeteer/Playwright can specify attacker-controlled browser binary paths and parameters. When the tool executes, the attacker-controlled executable/parameters are run on the host and circumvent the intended nodevm sandbox restrictions, resulting in execution of arbitrary code in the context of the host. This vulnerability was incorrectly assigned as a duplicate CVE-2025-26319 by the developers and should be considered distinct from that identifier.

Exploitation Scenario

An attacker with a low-privilege but valid Flowise account (e.g., a developer seat in a shared internal instance, or credentials obtained via phishing/credential stuffing) creates a new tool node that leverages the Puppeteer or Playwright integration. Instead of using the default browser binary, the attacker sets the executablePath parameter to a malicious script or binary path they control (or crafts launch arguments that achieve command execution), then triggers the agent to run that tool. Because the nodevm sandbox does not validate these parameters, the host launches the attacker-specified executable outside the intended isolation boundary, giving the attacker a shell or arbitrary code execution in the context of the Flowise server process — potentially exposing other agents, stored API keys, and internal network access from that host.

Weaknesses (CWE)

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection'): The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Implementation] If possible, ensure that all external commands called from the program are statically created.

Source: MITRE CWE corpus.