GHSA-9gvv-qjj3-2p6g

    Dashboard / Vulnerabilities / GHSA-9gvv-qjj3-2p6g

    GHSA-9gvv-qjj3-2p6g

    Published: 7 Oct 2026Last Modified: 31 Oct 2026

    Summary: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

    Details: Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the `vm2/@flowiseai/nodevm` JavaScript sandbox. An authenticated user with access to the `/api/v1/node-custom-function` endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. This allows execution of arbitrary OS commands as the Flowise process user (root in the official Docker image) and arbitrary host file disclosure via Chromium's `file://` URL handling. In versions 3.0.8–3.1.2 exploitation requires `ALLOW_BUILTIN_DEP=true`; earlier versions are exploitable by default. Fixed in 3.1.3.

    References: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9gvv-qjj3-2p6g, https://nvd.nist.gov/vuln/detail/CVE-2026-73483, https://github.com/FlowiseAI/Flowise, https://www.vulncheck.com/advisories/flowise-before-sandbox-escape-via-puppeteer

    Affected packages

    Package

    Name: flowise

    Purl: pkg:npm/flowise

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -3.1.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-9gvv-qjj3-2p6g | CVE-DB