Flowise versions before 3.1.3 contain a vulnerability (CWE-95) due to improper neutralization of directives in dynamically evaluated code ('Eval Injection'). Several custom-tool components insert a user-controlled baseURL directly into JavaScript source code executed in the vm2 sandbox without sufficient sanitization. Although the baseURL is validated by isValidURL, this check does not prevent injection of characters that break out of the string context, allowing an authenticated user to inject arbitrary JavaScript. Because the vm2 sandbox runs in the same Node.js process and exposes risky dependencies, the injected code can escape the sandbox and execute arbitrary code on the Flowise server as the process user. The vulnerability is fixed in version 3.1.3 by passing the URL as data instead of code and adding stricter validation.

An authenticated attacker can execute arbitrary code on the Flowise server with the privileges of the Flowise process user. This can lead to full compromise of the server hosting Flowise. The vulnerability requires authentication but no user interaction beyond that. The critical CVSS 4.0 score of 9 reflects the high impact and network attack vector with low complexity but requiring low privileges.

Upgrade Flowise to version 3.1.3 or later, where the vulnerability is fixed by changing how user-controlled URLs are handled in the sandbox and by adding stricter URL validation. No other mitigations are specified. Patch status is not explicitly stated but the vendor has fixed the issue in 3.1.3, so upgrading to this version or later is the recommended remediation.