Flowise RCE via SQLite Record Manager Node

============================================================================= Security Advisory elttam Topic: Flowise RCE via SQLite Record Manager Node Module: FlowiseAI/Flowise Disclosed: 24-Apr-2026 Credits: Alex Brown Affects: `FlowiseAI/Flowise 3.1.2` # I. Background Flowise AI is an open-source, low-code platform for building AI applications, such as chatbots, workflows, and autonomous agents, through an intuitive drag-and-drop interface, minimising the need for extensive coding. Flowise allows users to connect to a local SQLite database for record management of Upsert Vector Store operations. # II. Problem Description The database path for the "SQLite Record Manager" node could be overridden using the `additionalConfig` input, as demonstrated in the following code snippet. [https://github.com/FlowiseAI/Flowise/blob/flowise-components@3.1.2/packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts](https://github.com/FlowiseAI/Flowise/blob/flowise-components%403.1.2/packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts) ```ts class SQLiteRecordManager_RecordManager implements INode { ... async init(nodeData: INodeData, _: string, options: ICommonObject): Promise<any> { const _tableName = nodeData.inputs?.tableName as string const tableName = _tableName ? _tableName : 'upsertion_records' const additionalConfig = nodeData.inputs?.additionalConfig as string <1> const _namespace = nodeData.inputs?.namespace as string const namespace = _namespace ? _namespace : options.chatflowid const cleanup = nodeData.inputs?.cleanup as string const _sourceIdKey = nodeData.inputs?.sourceIdKey as string const sourceIdKey = _sourceIdKey ? _sourceIdKey : 'source' let additionalConfiguration = {} if (additionalConfig) { try { additionalConfiguration = typeof additionalConfig === 'object' ? additionalConfig : JSON.parse(additionalConfig) } catch (exception) { throw new Error('Invalid JSON in the Additional Configuration: ' + exception) } } const database = path.join(process.env.DATABASE_PATH ?? path.join(getUserHome(), '.flowise'), 'database.sqlite') <2> const sqliteOptions = { database, ...additionalConfiguration, <3> type: 'sqlite' } const args = { sqliteOptions, tableName: tableName } const recordManager = new SQLiteRecordManager(namespace, args) ;(recordManager as any).cleanup = cleanup ;(recordManager as any).sourceIdKey = sourceIdKey return recordManager } } ``` <1> The `additionalConfig` input was user controllable. <2> The intended SQLite database path. <3> Keyword argument expansion of the `additionalConfiguration` variable after the `database` variable, which allows overwriting the preceding `database` setting. An attacker could abuse this weakness to write an SQLite database to an arbitrary filepath, which includes system directories since the [`flowiseai/flowise:3.1.2`](https://hub.docker.com/layers/flowiseai/flowise/3.1.2/images/sha256-ddba104d8e50fbc1e72c6fe021d012be83e66d78d26816e1a6a3fddab4212eff) Docker image runs as `root`. However, unlike the [Flowise RCE via SQL Database Chain Node vulnerability](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-pwfj-wh95-7mwp), the executed SQL query was not user controllable and the `tableName` input was validated to match the `/^[a-zA-Z0-9_]+$/` regex pattern, as shown in the following code snippet. [https://github.com/FlowiseAI/Flowise/blob/flowise-components@3.1.2/packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManage

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Severity from

GitHub (reviewed advisory)

Weakness

CWE-94

Also known as

CVE-2026-69259

• github.com/FlowiseAI/Flowise/security/advisories/GHSA-x3hf-7cj6-3r4m
• github.com/FlowiseAI/Flowise/pull/6464
• github.com/FlowiseAI/Flowise/commit/d07186844263bad057008863037466aff7c3390f
• github.com/FlowiseAI/Flowise
• github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3