Advisoriesby IbisFlowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
Summary
A sandbox escape vulnerability in executeJavaScriptCode() allows any authenticated user to execute arbitrary system commands as root on the Flowise server. The function accepts caller-provided nodeVMOptions that override the
default sandbox security settings via JavaScript's spread operator, allowing an attacker to re-enable blocked modules like child_process and fs.
Details
The vulnerability is in packages/components/src/utils.ts at line 1755:
```typescript
const finalNodeVMOptions = { ...defaultNodeVMOptions, ...nodeVMOptions }
The executeJavaScriptCode() function (line 1569) creates a NodeVM sandbox with secure defaults that restrict which Node.js built-in modules can be required:
async (code, sandbox, options = {}) => {
const { nodeVMOptions = {} } = options;
// ...
const defaultNodeVMOptions = {
require: {
builtin: builtinDeps, // restricted allowlist , blocks child_process, fs, os, etc.
mock: secureWrappers
},
eval: false,
wasm: false
}
const finalNodeVMOptions = { ...defaultNodeVMOptions, ...nodeVMOptions } // ← VULN: caller overrides security settings
const vm = new NodeVM(finalNodeVMOptions)
}
`
The spread operator allows any caller to override require.builtin with ["*"], which permits all Node.js built-in modules...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| flowise npm | < 3.1.3 | 3.1.3 |
Details and references
### Summary A sandbox escape vulnerability in `executeJavaScriptCode()` allows any authenticated user to execute arbitrary system commands as root on the Flowise server. The function accepts caller-provided `nodeVMOptions` that override the default sandbox security settings via JavaScript's spread operator, allowing an attacker to re-enable blocked modules like `child_process` and `fs`. ### Details The vulnerability is in `packages/components/src/utils.ts` at line 1755: ```typescript const finalNodeVMOptions = { ...defaultNodeVMOptions, ...nodeVMOptions } The executeJavaScriptCode() function (line 1569) creates a NodeVM sandbox with secure defaults that restrict which Node.js built-in modules can be required: async (code, sandbox, options = {}) => { const { nodeVMOptions = {} } = options; // ... const defaultNodeVMOptions = { require: { builtin: builtinDeps, // restricted allowlist , blocks child_process, fs, os, etc. mock: secureWrappers }, eval: false, wasm: false } const finalNodeVMOptions = { ...defaultNodeVMOptions, ...nodeVMOptions } // ← VULN: caller overrides security settings const vm = new NodeVM(finalNodeVMOptions) } ``` The spread operator allows any caller to override require.builtin with ["*"], which permits all Node.js built-in modules including child_process. **Taint 01: Route Registration** `packages/server/src/routes/node-custom-functions/index.ts` (line 8) **Taint 02: Controller** `executeCustomFunction()` passes `req.body` to service , `packages/server/src/controllers/nodes/index.ts` (line 90) **Taint 03: Service** `executeCustomNodeFunction()` loads the `customFunction` node and calls `init()` with user-provided `javascriptFunction` , `packages/server/src/utils/executeCustomNodeFunction.ts` (line 49) **Taint 04: Sandbox Entry** Code runs inside NodeVM via `executeJavaScriptCode()` , `packages/components/src/utils.ts` (line 1760)
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-94
- Also known as
- CVE-2026-69254
More Flowise advisories
All Flowise
Flowise: information disclosureCVE-2026-70478fixed in 3.1.3Flowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityCVE-2026-70477fixed in 3.1.3Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing ManipulationCVE-2026-70476fixed in 3.1.3Flowise: missing authorizationCVE-2026-73603fixed in 3.1.4Flowise: Missing Authorization on Execution Update EndpointCVE-2026-70475fixed in 3.1.3Flowise: Cross-Workspace OAuth2 Credential Metadata LeakCVE-2026-70474fixed in 3.1.3