CVE-2026-69251: Flowise TypeORM config injection

Q: Is CVE-2026-69251 actively exploited?

No confirmed active exploitation of CVE-2026-69251 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-69251?

1) Upgrade flowise and flowise-components to 3.1.3 or later immediately — this is the only complete fix. 2) Until patched, restrict Record Manager and Agent Memory node configuration to trusted/admin users only via Flowise's RBAC, and disable self-service flow building for untrusted accounts. 3) Audit existing flows for additionalConfig values containing entities, subscribers, or migrations keys referencing unexpected file paths. 4) Restrict filesystem write access available to the Flowise process (upload directories, shared volumes) to reduce the attacker's ability to stage a malicious JS payload. 5) Monitor for the associated Nuclei template signature in WAF/IDS logs since automated scanning is already possible. 6) Rotate LLM provider API keys, database credentials, and any secrets accessible to the Flowise server if compromise is suspected, given the RCE has full process-level access.

Q: What systems are affected by CVE-2026-69251?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, agent memory systems, no-code/low-code AI builders.

Q: What is the CVSS score for CVE-2026-69251?

No CVSS score has been assigned yet.

CISO Take

Flowise, a drag-and-drop builder for LLM agent workflows, lets authenticated users pass arbitrary TypeORM DataSource options through the additionalConfig field of its Record Manager and Agent Memory nodes, and options like entities, subscribers, and migrations can point TypeORM at attacker-controlled JavaScript files that get loaded and executed. Any org self-hosting Flowise for agent orchestration should treat this as a full server-compromise path, not a minor config bug — a low-privilege authenticated user can escalate straight to code execution on the box running the LLM pipeline, with direct exposure to connected LLM API keys, database credentials, and vector store secrets. There is no public exploit yet and it is not in CISA KEV, but a Nuclei template already exists (automated scanning is possible) and EPSS puts it in the top 46% most likely to be exploited, while CISA's SSVC decision is ATTEND. This package also carries 158 other CVEs, signaling a broader pattern of insufficient input hardening. Patch to Flowise/flowise-components 3.1.3 immediately, and until then restrict who can create or edit Record Manager/Agent Memory nodes and audit flow configs for unexpected entities/subscribers/migrations values in additionalConfig.

Sources: NVD GitHub Advisory EPSS CISA KEV ATLAS Nuclei

What is the risk?

High impact, moderate-to-low current exploitation likelihood. The vulnerability yields unauthenticated-equivalent-outcome RCE (full server takeover) but requires an authenticated Flowise account to configure the malicious node, which caps casual exploitation. However, Flowise is frequently deployed as a multi-tenant or team-shared no-code tool where 'authenticated' often means 'any employee, contractor, or trial user with builder access' — a much lower bar than it sounds. No public PoC or KEV listing lowers immediate urgency, but the existence of a Nuclei template means mass scanning for vulnerable instances is trivial for anyone motivated to weaponize it, and EPSS at the 46th percentile is non-trivial for an unauthenticated-adjacent RCE class.

How does the attack unfold?

Payload staging

Attacker with authenticated Flowise access uploads or otherwise places a malicious JavaScript file on a path readable by the Flowise server process.

AML.T0079

Configuration injection

Attacker configures a Record Manager or Agent Memory node's additionalConfig.entities field to point to the staged JavaScript file.

AML.T0081

Code execution

When the flow runs, TypeORM initializes the DataSource with the attacker-supplied entities option and loads/executes the JavaScript file on the server.

AML.T0050

Impact: server compromise

Attacker achieves arbitrary code execution in the Flowise process context, enabling pivot to LLM API keys, database credentials, and other connected secrets.

AML.T0112

Payload staging

Attacker with authenticated Flowise access uploads or otherwise places a malicious JavaScript file on a path readable by the Flowise server process.

AML.T0079

Configuration injection

Attacker configures a Record Manager or Agent Memory node's additionalConfig.entities field to point to the staged JavaScript file.

AML.T0081

Code execution

When the flow runs, TypeORM initializes the DataSource with the attacker-supplied entities option and loads/executes the JavaScript file on the server.

AML.T0050

Impact: server compromise

Attacker achieves arbitrary code execution in the Flowise process context, enabling pivot to LLM API keys, database credentials, and other connected secrets.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	<= 3.1.2	`3.1.3`
Flowise	npm	<= 3.1.2	`3.1.3`

How severe is it?

CVSS 3.1

N/A

EPSS

3.3%

chance of exploitation in 30 days

Higher than 88% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Nuclei detection template available

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

1) Upgrade flowise and flowise-components to 3.1.3 or later immediately — this is the only complete fix. 2) Until patched, restrict Record Manager and Agent Memory node configuration to trusted/admin users only via Flowise's RBAC, and disable self-service flow building for untrusted accounts. 3) Audit existing flows for additionalConfig values containing entities, subscribers, or migrations keys referencing unexpected file paths. 4) Restrict filesystem write access available to the Flowise process (upload directories, shared volumes) to reduce the attacker's ability to stage a malicious JS payload. 5) Monitor for the associated Nuclei template signature in WAF/IDS logs since automated scanning is already possible. 6) Rotate LLM provider API keys, database credentials, and any secrets accessible to the Flowise server if compromise is suspected, given the RCE has full process-level access.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Agent Framework RAG AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0081 - Modify AI Agent Configuration AML.T0112 - Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system operation and monitoring / third-party and customer requirements

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-69251?

Flowise, a drag-and-drop builder for LLM agent workflows, lets authenticated users pass arbitrary TypeORM DataSource options through the additionalConfig field of its Record Manager and Agent Memory nodes, and options like entities, subscribers, and migrations can point TypeORM at attacker-controlled JavaScript files that get loaded and executed. Any org self-hosting Flowise for agent orchestration should treat this as a full server-compromise path, not a minor config bug — a low-privilege authenticated user can escalate straight to code execution on the box running the LLM pipeline, with direct exposure to connected LLM API keys, database credentials, and vector store secrets. There is no public exploit yet and it is not in CISA KEV, but a Nuclei template already exists (automated scanning is possible) and EPSS puts it in the top 46% most likely to be exploited, while CISA's SSVC decision is ATTEND. This package also carries 158 other CVEs, signaling a broader pattern of insufficient input hardening. Patch to Flowise/flowise-components 3.1.3 immediately, and until then restrict who can create or edit Record Manager/Agent Memory nodes and audit flow configs for unexpected entities/subscribers/migrations values in additionalConfig.

Is CVE-2026-69251 actively exploited?

No confirmed active exploitation of CVE-2026-69251 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-69251?

1) Upgrade flowise and flowise-components to 3.1.3 or later immediately — this is the only complete fix. 2) Until patched, restrict Record Manager and Agent Memory node configuration to trusted/admin users only via Flowise's RBAC, and disable self-service flow building for untrusted accounts. 3) Audit existing flows for additionalConfig values containing entities, subscribers, or migrations keys referencing unexpected file paths. 4) Restrict filesystem write access available to the Flowise process (upload directories, shared volumes) to reduce the attacker's ability to stage a malicious JS payload. 5) Monitor for the associated Nuclei template signature in WAF/IDS logs since automated scanning is already possible. 6) Rotate LLM provider API keys, database credentials, and any secrets accessible to the Flowise server if compromise is suspected, given the RCE has full process-level access.

What systems are affected by CVE-2026-69251?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, agent memory systems, no-code/low-code AI builders.

What is the CVSS score for CVE-2026-69251?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesagent memory systemsno-code/low-code AI builders

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0081 Modify AI Agent Configuration

AML.T0112 Machine Compromise

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts, packages/components/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts, packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts, packages/components/nodes/memory/AgentMemory/MySQLAgentMemory/MySQLAgentMemory.ts, and packages/components/nodes/memory/AgentMemory/AgentMemory.ts. TypeORM DataSource options such as entities, subscribers, and migrations can load local JavaScript files, allowing an authenticated user to execute arbitrary code on the server by uploading a JavaScript payload and referencing it from additionalConfig.entities. This issue is fixed in version 3.1.3.

Exploitation Scenario

An attacker with a low-privilege authenticated Flowise account (e.g., a contractor invited to build one workflow, or a compromised employee credential) uploads or otherwise stages a malicious JavaScript file on a path the Flowise server process can read. They then create or edit a flow using a Postgres or MySQL Record Manager (or AgentMemory) node and set additionalConfig.entities to point to that staged file. When the flow is saved and executed, TypeORM instantiates the DataSource with the attacker-supplied entities option, loading and executing the JavaScript file as part of normal ORM initialization — giving the attacker arbitrary code execution in the context of the Flowise server, from which they can pivot to any LLM API keys, vector database credentials, or internal network access the server holds.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.