CVE-2026-69254: Flowise authenticated RCE as root

Q: Is CVE-2026-69254 actively exploited?

No confirmed active exploitation of CVE-2026-69254 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-69254?

Upgrade to Flowise 3.1.3 or later immediately, where the merge of caller-supplied nodeVMOptions over default NodeVM security settings is fixed. If immediate patching isn't possible, restrict access to the custom-function node feature and the node-custom-functions API route to trusted administrators only, disable self-service account creation, and review existing custom function nodes for unexpected requires.builtin or nodeVMOptions overrides. For detection, monitor the Flowise server process for unexpected child_process spawns, unusual outbound network connections, or root-level shell activity correlated with custom-function execution events; audit application logs for calls to the node-custom-functions endpoint from non-admin accounts. Run the Flowise server process with least-privilege OS permissions (never as root) as defense-in-depth against future sandbox-escape classes of bugs.

Q: What systems are affected by CVE-2026-69254?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code/no-code AI builders.

Q: What is the CVSS score for CVE-2026-69254?

No CVSS score has been assigned yet.

CISO Take

Flowise's custom-function execution engine let any authenticated user override the NodeVM sandbox's security settings, re-enable the child_process built-in, and run arbitrary OS commands as root on the underlying server. This isn't a theoretical sandbox weakness — it's a full remote code execution path in an agent-building platform that ships custom function nodes as a core feature, meaning any low-privilege user with a Flowise account can pivot straight to host takeover. The blast radius is amplified by Flowise's track record of 158 prior CVEs in the same package, and CISA's SSVC rates this ATTEND rather than immediate action, with EPSS at 0.36% and no public exploit or Nuclei template yet — but low current exploitation activity is not the same as low severity for a root-level RCE. Patch to Flowise 3.1.3 immediately; until then, restrict who can create or edit custom function nodes to trusted admins only, and treat any Flowise instance exposing multi-tenant or self-service account creation as high risk. Monitor for unexpected child_process spawns or outbound connections originating from the Flowise server process as a detection signal.

Sources: NVD GitHub Advisory EPSS CISA KEV ATLAS

What is the risk?

High impact, moderate exploitability. Impact is severe — full root-level command execution on the Flowise host, not just within the application sandbox — but exploitation requires an authenticated account with access to create or edit custom function nodes, which limits exposure primarily to multi-user or self-service Flowise deployments. No public exploit code, Nuclei template, or CISA KEV listing exists yet, and EPSS is low (0.36%), consistent with CISA's SSVC 'ATTEND' rating (respond during normal cycles, not emergency). However, the underlying flaw — trusting caller-supplied nodeVMOptions and merging them over secure defaults — is a straightforward, well-understood sandbox-escape pattern that is trivial to weaponize once an attacker has the required authenticated access, so risk should be treated as time-sensitive for any instance with open or loosely-controlled user registration.

How does the attack unfold?

Authenticated Access

Attacker obtains a standard authenticated account on a multi-user Flowise instance.

AML.T0012

Malicious Tool Creation

Attacker creates a Custom Function node that re-invokes executeJavaScriptCode() with attacker-controlled nodeVMOptions.

AML.T0053

Sandbox Escape

Overriding nodeVMOptions.require.builtin unlocks all Node.js built-ins, defeating the NodeVM's default security restrictions.

AML.T0105

Arbitrary Command Execution

Attacker requires child_process and runs arbitrary OS commands as root, achieving full host compromise.

AML.T0050

Authenticated Access

Attacker obtains a standard authenticated account on a multi-user Flowise instance.

AML.T0012

Malicious Tool Creation

Attacker creates a Custom Function node that re-invokes executeJavaScriptCode() with attacker-controlled nodeVMOptions.

AML.T0053

Sandbox Escape

Overriding nodeVMOptions.require.builtin unlocks all Node.js built-ins, defeating the NodeVM's default security restrictions.

AML.T0105

Arbitrary Command Execution

Attacker requires child_process and runs arbitrary OS commands as root, achieving full host compromise.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	<= 3.1.2	`3.1.3`
Flowise	npm	<= 3.1.2	`3.1.3`

How severe is it?

CVSS 3.1

N/A

EPSS

0.7%

chance of exploitation in 30 days

Higher than 50% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

Upgrade to Flowise 3.1.3 or later immediately, where the merge of caller-supplied nodeVMOptions over default NodeVM security settings is fixed. If immediate patching isn't possible, restrict access to the custom-function node feature and the node-custom-functions API route to trusted administrators only, disable self-service account creation, and review existing custom function nodes for unexpected requires.builtin or nodeVMOptions overrides. For detection, monitor the Flowise server process for unexpected child_process spawns, unusual outbound network connections, or root-level shell activity correlated with custom-function execution events; audit application logs for calls to the node-custom-functions endpoint from non-admin accounts. Run the Flowise server process with least-privilege OS permissions (never as root) as defense-in-depth against future sandbox-escape classes of bugs.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Agent Plugin Framework AML.T0012 - Valid Accounts AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0105 - Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

Annex A.6.2 - AI system technical documentation and security controls

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-69254?

Flowise's custom-function execution engine let any authenticated user override the NodeVM sandbox's security settings, re-enable the child_process built-in, and run arbitrary OS commands as root on the underlying server. This isn't a theoretical sandbox weakness — it's a full remote code execution path in an agent-building platform that ships custom function nodes as a core feature, meaning any low-privilege user with a Flowise account can pivot straight to host takeover. The blast radius is amplified by Flowise's track record of 158 prior CVEs in the same package, and CISA's SSVC rates this ATTEND rather than immediate action, with EPSS at 0.36% and no public exploit or Nuclei template yet — but low current exploitation activity is not the same as low severity for a root-level RCE. Patch to Flowise 3.1.3 immediately; until then, restrict who can create or edit custom function nodes to trusted admins only, and treat any Flowise instance exposing multi-tenant or self-service account creation as high risk. Monitor for unexpected child_process spawns or outbound connections originating from the Flowise server process as a detection signal.

Is CVE-2026-69254 actively exploited?

No confirmed active exploitation of CVE-2026-69254 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-69254?

Upgrade to Flowise 3.1.3 or later immediately, where the merge of caller-supplied nodeVMOptions over default NodeVM security settings is fixed. If immediate patching isn't possible, restrict access to the custom-function node feature and the node-custom-functions API route to trusted administrators only, disable self-service account creation, and review existing custom function nodes for unexpected requires.builtin or nodeVMOptions overrides. For detection, monitor the Flowise server process for unexpected child_process spawns, unusual outbound network connections, or root-level shell activity correlated with custom-function execution events; audit application logs for calls to the node-custom-functions endpoint from non-admin accounts. Run the Flowise server process with least-privilege OS permissions (never as root) as defense-in-depth against future sandbox-escape classes of bugs.

What systems are affected by CVE-2026-69254?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code/no-code AI builders.

What is the CVSS score for CVE-2026-69254?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworkslow-code/no-code AI builders

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0105 Escape to Host

Compliance Controls Affected

ISO 42001: Annex A.6.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode() accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching packages/server/src/routes/node-custom-functions/index.ts could run a custom function that imported flowise-components/dist/src/utils.js, called executeJavaScriptCode() again with nodeVMOptions.require.builtin set to allow all built-in modules, and then required child_process to execute arbitrary system commands as root on the Flowise server. This issue is fixed in version 3.1.3.

Exploitation Scenario

An attacker obtains a standard (non-admin) authenticated account on a shared Flowise instance — via self-service signup, a phished credential, or an insider with limited privileges. They create or edit a Custom Function node in a workflow, writing JavaScript that imports flowise-components/dist/src/utils.js and calls executeJavaScriptCode() a second time, this time supplying nodeVMOptions.require.builtin set to allow all Node.js built-in modules. This overrides the platform's default sandbox restrictions, letting the attacker's code require('child_process') and execute arbitrary OS commands. Because the Flowise server process runs as root, the attacker now has full host compromise — enough to pivot to connected databases, exfiltrate LLM API keys and vector store credentials, or use the box as a foothold into the broader network.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.