GHSA-g32j-mmxr-gfq5 Flowise RCE via TypeORM DataSource
=============================================================================
                                                            Security Advisory
                                                                       elttamTopic:          Flowise RCE via TypeORM DataSourceModule:         FlowiseAI/Flowise
Disclosed:      15-Apr-2026
Credits:        Alex Brown
Affects:        `FlowiseAI/Flowise 3.1.2`I.   BackgroundFlowise AI is an open-source, low-code platform for building AI applications—such as chatbots, workflows, and autonomous agents—through an intuitive drag-and-drop interface, minimising the need for extensive coding.Flowise allows users to connect to remote databases within a flow, which is performed using the [TypeORM `DataSource`](https://typeorm.io/docs/data-source/data-source).II.  Problem DescriptionThe following nodes allowed users to set arbitrary options for the TypeORM `DataSource` class using the `additionalConfig` node input:[packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts](https://github.com/FlowiseAI/Flowise/blob/flowise-components%403.1.2/packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts#L122)[packages/components/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts](https://github.com/FlowiseAI/Flowise/blob/465005a5036d9c4e5e3a7675527fa4cf9cff7507/packages/components/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts)[packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts](https://github.com/FlowiseAI/Flowise/blob/465005a5036d9c4e5e3a7675527fa4cf9cff7507/packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts)[packages/components/nodes/memory/AgentMemory/MySQLAgentMemory/MySQLAgentMemory.ts](https://github.com/FlowiseAI/Flowise/blob/5a37227d14dbe34234aa1cca97bc12092e0dbcd6/packages/components/nodes/memory/AgentMemory/MySQLAgentMemory/MySQLAgentMemory.ts)[packages/components/nodes/memory/AgentMemory/AgentMemory.ts](https://github.com/FlowiseAI/Flowise/blob/5a37227d14dbe34234aa1cca97bc12092e0dbcd6/packages/components/nodes/memory/AgentMemory/AgentMemory.ts)This is considered a dangerous coding practice, because the [options for the TypeORM `DataSource` class support loading local files as JavaScript code](https://typeorm.io/docs/data-source/data-source).The following documents the steps to reproduce this RCE vulnerability by abusing the `additionalConfig` input on a MySQL Record Manager (`packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts`) node:Log into a Flowise instance and note the organisation ID in the response from `POST /api/v1/auth/login`, as shown below.<1> The organisation ID that is required for a later step.Create a new document store and use the File Loader to upload a file containing JavaScript code that would be executed outside the `vm2` sandbox. The following script is a reverse shell payload that connects to `172.17.0.1:1337` that had a filename of `rce.js`.Using a proxy tool such as Burp Suite or the browser's debug network tab, observe the response from the 
`POST /api/v1/document-store/loader/process/{loader_id}` endpoint and retrieve the `storeId`, as demonstrated in the response below.<1> The store ID that is required for a later step.Import the following Chatflow and configure the "MySQL Record Manager", "OpenAI Embedding" and "Weaviate" nodes.[typeorm-datasource-rce.json](https://github.com/user-attachments/files/26752045/typeorm-datasource-rce.json)Open the "Additional Parameters" window for the "MySQL Record Manager" node replace the placeholder values in the `additionalConfig.entities` setting. The `${HOME}` is the home directory of the user running the Flowise server (e.g., [`/root` on the published Docker image](https://hub.docker.com/layers/flowiseai/flowise/3.1.2/images/sha256-ddba104d8e50fbc1e72c6fe021d012be83e66d78d26816e1a6a3fddab4212eff)). The screenshot below shows an example path for the reverse shell payload that was uploaded in the previous steps.Start an Upsert operation and observe the reverse shell payload being executed, as demonstrated in the terminal output below.III. ImpactThis sandbox escape vulnerability allows an authenticated user to execute arbitrary code on a server running Flowise, resulting in full compromise of the application.IV.  SolutionDo not allow users full control of the options for the TypeORM `DataSource` class. The following [`DataSource` options](https://typeorm.io/docs/data-source/data-source-options/) are considered dangerous and should not be allowed:`extra`: Could be abused to provide dangerous driver options.`entities`: Could be abused to load arbitrary JavaScript files.`subscribers`: Could be abused to load arbitrary JavaScript files.`migrations`: Could be abused to load arbitrary JavaScript files.
CVSS v4.0 score: 9