Flowise (packages flowise and flowise-components) versions <= 3.1.2 have a sandbox escape vulnerability in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated attacker with access to the /api/v1/node-custom-function endpoint can supply attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. This leads to arbitrary OS command execution as the Flowise process user (root in the official Docker image) and arbitrary host file disclosure via Chromium's file:// URL handling. Exploitation in versions 3.0.8 to 3.1.2 requires the environment variable ALLOW_BUILTIN_DEP=true; versions prior to 3.0.8 are exploitable by default. The vulnerability is fixed in version 3.1.3.

Successful exploitation allows an authenticated user to execute arbitrary OS commands with the privileges of the Flowise process user, which is root in the official Docker image. This can lead to full system compromise and arbitrary host file disclosure via Chromium's file:// URL handling. The vulnerability significantly compromises the confidentiality, integrity, and availability of the affected system.

A fix is available in Flowise version 3.1.3. Users should upgrade to version 3.1.3 or later to remediate this vulnerability. Until upgrading, restrict access to the /api/v1/node-custom-function endpoint to trusted users only and avoid setting ALLOW_BUILTIN_DEP=true in versions 3.0.8 to 3.1.2. Patch status is confirmed by the vendor stating the issue is fixed in 3.1.3.