Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore

Summary

Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth package via LocalFileStore and requires it, escaping vm2 as the Flowise process user.

Remediation

1. Inventory every FlowiseAI Flowise deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Advisoryhttps://www.vulncheck.com/advisories/flowise-through-3.1.4-custom-function-sandbox-escape-rce-via-localfilestore
• Referencehttps://github.com/FlowiseAI/Flowise
• Referencehttps://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c95/packages/components/src/utils.ts#L1733
• Referencehttps://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c95/packages/components/src/utils.ts#L55-L114
• Referencehttps://github.com/advisories/GHSA-9gvv-qjj3-2p6g
• Referencehttps://github.com/soovwv/cve/blob/a37354aff1e78c0601772e7716f5318c473e8640/CVE-2026-119978.md