Threats tagged 'ghsa-x3hf-7cj6-3r4m'

CVE-2026-69259 is a critical code injection vulnerability in FlowiseAI's Flowise prior to version 3.1.3. The SQLite Record Manager node improperly handles user-controlled configuration, allowing an authenticated attacker to overwrite the SQLite database path. Exploiting this, an attacker running the published Docker image as root could write malicious SQLite databases to sensitive system paths such as /etc/chromium/exploit.conf. By controlling database content, the attacker could inject shell syntax that executes when Puppeteer launches Chromium and sources configuration files. This vulnerability is fixed in Flowise version 3.1.3.