Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to ins...
Date: 2025-10
Affected: flowiseai/flowise
Attack vector: sandbox-escape
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2024-31621
CVE-2024-36420
CVE-2024-36421
CVE-2024-36422
CVE-2024-36423
CVE-2024-37145
CVE-2024-37146
CVE-2024-58351
CVE-2024-8181
CVE-2024-8182
CVE-2025-26319
CVE-2025-29192
CVE-2025-34267
CVE-2025-50538
CVE-2025-54994
CVE-2025-55346
CVE-2025-57164
CVE-2025-58434
CVE-2025-59527
CVE-2025-59528
CVE-2025-61687
CVE-2025-61913
CVE-2025-71324
CVE-2025-71327
CVE-2025-71328
CVE-2025-71331
CVE-2025-71332
CVE-2025-71333
CVE-2025-71334
CVE-2025-71335
CVE-2025-71336
CVE-2025-71337
CVE-2025-71338
CVE-2025-8943
CVE-2026-22252
CVE-2026-22688
CVE-2026-30615
CVE-2026-30616
CVE-2026-30617
CVE-2026-30624
CVE-2026-30625
CVE-2026-30820
CVE-2026-30821
CVE-2026-30822
CVE-2026-30823
CVE-2026-30824
CVE-2026-31829
CVE-2026-40933
CVE-2026-41137
CVE-2026-41138
CVE-2026-41264
CVE-2026-41265
CVE-2026-41266
CVE-2026-41267
CVE-2026-41268
CVE-2026-41269
CVE-2026-41270
CVE-2026-41271
CVE-2026-41272
CVE-2026-41273
CVE-2026-41274
CVE-2026-41275
CVE-2026-41276
CVE-2026-41277
CVE-2026-41278
CVE-2026-41279
CVE-2026-42861
CVE-2026-42862
CVE-2026-42863
CVE-2026-43995
CVE-2026-46440
CVE-2026-46441
CVE-2026-46442
CVE-2026-46443
CVE-2026-46444
CVE-2026-46475
CVE-2026-46476
CVE-2026-46477
CVE-2026-46478
CVE-2026-46479
CVE-2026-46480
CVE-2026-56267
CVE-2026-56268
CVE-2026-56269
CVE-2026-56270
CVE-2026-56272
CVE-2026-56274
CVE-2026-56275
CVE-2026-56276
CVE-2026-56277
CVE-2026-56278
CVE-2026-8026
CWE: CWE-15
CWE-184
CWE-20
CWE-200
CWE-22
CWE-284
CWE-285
CWE-287
CWE-306
CWE-312
CWE-319
CWE-327
CWE-346
CWE-400
CWE-434
CWE-522
CWE-613
CWE-620
CWE-627
CWE-639
CWE-73
CWE-74
CWE-77
CWE-78
CWE-79
CWE-798
CWE-80
CWE-862
CWE-863
CWE-89
CWE-915
CWE-916
CWE-918
CWE-94
CWE-942
CWE-943
CWE-95
CVSS: 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execution environment. An authenticated attacker able to create or run a tool that leverages Puppeteer/Playwright can specify attacker-controlled browser binary paths and parameters. When the tool executes, the attacker-controlled executable/parameters are run on the host and circumvent the intended nodevm sandbox restrictions, resulting in execution of arbitrary code in the context of the host. This vulnerability was incorrectly assigned as a duplicate CVE-2025-26319 by the developers and should be considered distinct from that identifier.

Impact: Full system takeover; actively exploited in the wild; CVSS 10.0

Mitigations:
Input sanitization for MCP configurations
Reduce publicly exposed AI framework instances
Sandbox execution for user-provided configurations

Architectural layers (MAESTRO):