GHSA-wg86-r78f-74mp Flowise Sandbox Escape to RCE
=============================================================================
                                                            Security Advisory
                                                                       elttamTopic:          Flowise JavaScript Sandbox EscapeModule:         FlowiseAI/Flowise, FlowiseAI/nodevm
Disclosed:      11-Apr-2026
Credits:        Luke Jahnke and Alex Brown
Affects:        `FlowiseAI/Flowise 3.1.1`, `FlowiseAI/nodevm  3.9.25`I.   BackgroundFlowise AI is an open-source, low-code platform for building AI applications—such as chatbots, workflows, and autonomous agents—through an intuitive drag-and-drop interface, minimising the need for extensive coding.The platform also enables execution of custom JavaScript within a sandboxed environment via the Custom Function Agent Flow node or Custom Tool. By default, this sandbox is powered by `patriksimek/vm2`, a fork of the `patriksimek/vm2` package.II.  Problem Description**NOTE**: This vulnerability still impacts commit `dddfb3c90eec900d747790a439bd362a764039cd` (the latest commit on the main branch at the time of writing). The original report was incorrectly closed, due to a misunderstanding that the report was about the use of an outdated and vulnerable version of the `patriksimek/vm2` sandbox. The sandbox escape that this report documents is an issue with Flowise, and patching the `vm2` sandbox would not resolve it.The `patriksimek/vm2` sandbox executes JavaScript within the same Node.js process, which introduces significant security limitations and makes safely isolating untrusted code inherently difficult. Due to these concerns, the maintainers had deprecated the project and previously issued the following warning:*https://github.com/n8n-io/vm2*The library contains critical security issues and should not be used in production. Maintenance has been discontinued. Consider migrating to `isolated-vm`.To demonstrate the risks associated with the use of the `vm2` sandbox, a sandbox escape specific to Flowise was investigated. The code snippet below shows the allowed modules that could be used within custom JavaScript code on Flowise.https://github.com/FlowiseAI/Flowise/blob/flowise%403.1.1/packages/components/src/utils.ts#L124<1> Allows custom JavaScript code to use the `axios`, `moment` and `node-fetch` dependencies.Notably, the `moment` dependency had a previously reported path traversal vulnerability (`CVE-2022-24785`) that could lead to RCE when user input is passed to the `locale` function. The patch for `CVE-2022-24785` was implementing regex check to disallow `/` or `\` characters within a locale name, as shown in the code snippet below.*Patch for `CVE-2022-24785` in `moment` (https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5)*<1> Performs a regex check to disallow `/` or `\` characters within the provided locale name.<2> The vulnerable sink that introduced `CVE-2022-24785`.Flowise used `moment` version `v2.29.3`, which had the `CVE-2022-24785` patch applied. However, the patch is ineffective in preventing directory traversal in a sandbox context. The validation function uses the `match` function from the provided object, so an object with a `match` function that always returns `true` would bypass the validation check, as shown in the following proof-of-concept script.<1> Bypasses the validation check for `CVE-2022-24785`.In commit `e765367fdc9761a7d9cf01a048cac15c78903b85` (https://github.com/FlowiseAI/Flowise/commit/e765367fdc9761a7d9cf01a048cac15c78903b85), the default sandbox was changed to the E2B sandbox, as shown in the code snippet below.https://github.com/FlowiseAI/Flowise/blob/e765367fdc9761a7d9cf01a048cac15c78903b85/packages/components/src/utils.ts<1> The default was changed to use the E2B sandbox.However, there are several components within the application that still use the insecure `vm2` sandbox, as shown in the following `grep` output.The above files also contain an injection vulnerability into the sandboxed code, due to an improper URL validation check validating the `baseURL` input. The following code snippets demonstrate the injection vulnerability within `AgentAsTool.ts` and the broken `isValidURL` validation function.https://github.com/FlowiseAI/Flowise/blob/0c6924bb08a2156513b447d0e600651f29ea5aa8/packages/components/nodes/tools/AgentAsTool/AgentAsTool.ts<1> Use of the broken `isValidURL` validation function, that is shown below.
<2> Injection via the `baseURL` setting into the sandboxed code.
<3> Uses the insecure `vm2` sandbox.https://github.com/FlowiseAI/Flowise/blob/aff06479aa9ec24847bd65ac786b46ac85ae7e03/packages/components/src/validator.ts<1> The JavaScript `URL` class does not validate characters in the URL hash fragment.An attacker could inject arbitrary code by inserting `#";\n{malicious_code};//` at the end of the `baseURL` setting, where the following `baseURL` demonstrates injecting the payload for the sandbox escape shown above to execute the code in the file `/tmp/evil.txt` outside the `vm2` sandbox.The following documents the procedure to remotely exploit the insecure `vm2` sandbox to achieve RCE on Flowise using the `AgentAsTool` node.**Note:** This procedure documents the method of exploitation on the Docker deployment. The exploitation methodology may be different on the cloud deployment.Log into a Flowise instance and note the organisation ID in the response from `POST /api/v1/auth/login`, as shown below.<1> The organisation ID that is required for a later step.Create a new document store and use the File Loader to upload a file containing JavaScript code that would be executed outside the `vm2` sandbox. The following script is a reverse shell payload that connects to `172.17.0.1:1337` that had a filename of `rce.js`.Using a proxy tool such as Burp Suite or the browser's debug network tab, observe the response from the 
`POST /api/v1/document-store/loader/process/{loader_id}` endpoint and retrieve the `storeId`, as demonstrated in the response below.<1> The store ID that is required for a later step.Navigate to the Agentflow tab and create a new empty Agent that would be attached to the `AgentAsTool` node.Navigate to the Chatflow tab and create a new Chatflow and save it. Then add an Agent as Tool node using the previously created Agentflow, a Buffer Memory Node, an Open AI Chat Model node and connect them to a Tool Agent node, then save the changes, as shown in the attached screenshot. Using a tool such as Burp Suite, intercept the request to the `PUT /api/v1/chatflows/{chatflow_id}` and modify the `baseURL` input to `"https://192.168.122.62:3000/#\";\nfake = new String(\"../../../../../../../../../../../../../../../../..{home_folder}/.flowise/storage/{organisation_id}/docustore/{store_id}/{filename}\");\nfake.match = function(regexp){return true;};\nrequire(\"moment\").locale(fake);//"`, where the `{home_folder}` is `/home/node` if built locally using `https://github.com/FlowiseAI/Flowise/blob/main/Dockerfile` or `/root` if using a published Docker image from https://hub.docker.com/r/flowiseai/flowise. Replace the `{organisation_id}`, `{store_id}` and `{filename}` placeholders with the values from the previous steps. The following request demonstrates setting the sandbox escape payload to execute the uploaded payload that was located at `/home/node/.flowise/storage/dbac2c65-6d98-48c2-b515-0b6cfb32f7e7/docustore/dd6e5e1a-9c17-4a80-ad97-87302d9aa549/rce.js`.Send a chat message using the Chatflow and observe the reverse shell payload being executed outside the `vm2` sandbox, as shown in the terminal output below.<1> Confirmation that the sandbox escape impacts Flowise commit `dddfb3c90eec900d747790a439bd362a764039cd`.III. ImpactThis sandbox escape vulnerability allows an authenticated user to execute arbitrary code on a server running Flowise that uses the default `vm2` sandbox, resulting in full compromise of the application.IV.  SolutionThe current maintainers of the `vm2` sandbox strongly advise against executing untrusted code within it due to security risks (https://github.com/patriksimek/vm2?tab=readme-ov-file#important-security-disclaimer). To prevent JavaScript sandbox escapes in Flowise, a more secure alternative, such as https://github.com/laverdet/isolated-vm, should be used.Updating to the latest version of `vm2` sandbox will not patch this sandbox escape vulnerability.V.   References`vm2` Security Disclaimer: https://github.com/patriksimek/vm2?tab=readme-ov-file#important-security-disclaimer`isolated-vm`: https://github.com/laverdet/isolated-vm
CVSS v4.0 score: 9