Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

### Summary A sandbox escape vulnerability in `executeJavaScriptCode()` allows any authenticated user to execute arbitrary system commands as root on the Flowise server. The function accepts caller-provided `nodeVMOptions` that override the default sandbox security settings via JavaScript's spread operator, allowing an attacker to re-enable blocked modules like `child_process` and `fs`. ### Details The vulnerability is in `packages/components/src/utils.ts` at line 1755: ```typescript const finalNodeVMOptions = { ...defaultNodeVMOptions, ...nodeVMOptions } The executeJavaScriptCode() function (line 1569) creates a NodeVM sandbox with secure defaults that restrict which Node.js built-in modules can be required: async (code, sandbox, options = {}) => { const { nodeVMOptions = {} } = options; // ... const defaultNodeVMOptions = { require: { builtin: builtinDeps, // restricted allowlist , blocks child_process, fs, os, etc. mock: secureWrappers }, eval: false, wasm: false } const finalNodeVMOptions = { ...defaultNodeVMOptions, ...nodeVMOptions } // ← VULN: caller overrides security settings const vm = new NodeVM(finalNodeVMOptions) } ``` The spread operator allows any caller to override require.builtin with ["*"], which permits all Node.js built-in modules including child_process. **Taint 01: Route Registration** `packages/server/src/routes/node-custom-functions/index.ts` (line 8) **Taint 02: Controller** `executeCustomFunction()` passes `req.body` to service , `packages/server/src/controllers/nodes/index.ts` (line 90) **Taint 03: Service** `executeCustomNodeFunction()` loads the `customFunction` node and calls `init()` with user-provided `javascriptFunction` , `packages/server/src/utils/executeCustomNodeFunction.ts` (line 49) **Taint 04: Sandbox Entry** Code runs inside NodeVM via `executeJavaScriptCode()` , `packages/components/src/utils.ts` (line 1760)

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Severity from

GitHub (reviewed advisory)

Weakness

CWE-94

Also known as

CVE-2026-69254

• github.com/FlowiseAI/Flowise/security/advisories/GHSA-3769-jgqc-cxm7
• github.com/FlowiseAI/Flowise/pull/6306
• github.com/FlowiseAI/Flowise/commit/3086cb7e323bb96c5a581d3232ef975b0d92183d
• github.com/FlowiseAI/Flowise
• github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3