GHSA-3769-jgqc-cxm7 Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
SummaryA sandbox escape vulnerability in `executeJavaScriptCode()` allows any authenticated user to execute arbitrary system commands as root on the Flowise server. The function accepts caller-provided `nodeVMOptions` that override the
  default sandbox security settings via JavaScript's spread operator, allowing an attacker to re-enable blocked modules like `child_process` and `fs`.DetailsThe vulnerability is in `packages/components/src/utils.ts` at line 1755:The spread operator allows any caller to override require.builtin with ["*"], which permits all Node.js built-in modules including child_process.**Taint 01: Route Registration**                                                                                                                                                                                                           
  `packages/server/src/routes/node-custom-functions/index.ts` (line 8)**Taint 02: Controller**                                                                                                                                                                                                                   
  `executeCustomFunction()` passes `req.body` to service — `packages/server/src/controllers/nodes/index.ts` (line 90)**Taint 03: Service**
  `executeCustomNodeFunction()` loads the `customFunction` node and calls `init()` with user-provided `javascriptFunction` — `packages/server/src/utils/executeCustomNodeFunction.ts` (line 49)**Taint 04: Sandbox Entry**                                                                                                                                                                                                                
  Code runs inside NodeVM via `executeJavaScriptCode()` — `packages/components/src/utils.ts` (line 1760)**Taint 05: Escape**
  Inside the sandbox, the attacker requires `flowise-components/dist/src/utils.js` by absolute path (bypassing the module allowlist), obtaining a reference to `executeJavaScriptCode()` itself**Taint 06: Override**
  The attacker calls `executeJavaScriptCode()` with `nodeVMOptions: { require: { builtin: ["*"] } }`, which overrides the security defaults at line 1755: `{ ...defaultNodeVMOptions, ...nodeVMOptions }`**Taint 07: RCE**                                                                                                                                                                                                                          
  Inside the nested VM, `require("child_process")` succeeds. Arbitrary commands execute as root.PoC**Step 1: Start Flowise****Step 2: Obtain Bearer Token**Register an account, then create an API key:**Step 3: Create Payload****Step 4: Exploit**ImpactFull remote code execution as root. Any authenticated user with a valid API key can execute arbitrary system commands on the host, read any file on the filesystem including the encryption key at `/root/.flowise/encryption.key` (which  
  decrypts every stored credential - API keys, OAuth tokens, database passwords) and the JWT signing secret at `/root/.flowise/jwt_auth_token_secret.key` (which allows forging authentication tokens for any user), and establish persistent
   access via cron jobs or reverse shells. All Flowise deployments running >= 3.0.5 through 3.1.1 (latest) are affected.
CVSS v4.0 score: 9.4