{"id":"CVE-2026-69253","sourceIdentifier":"security-advisories@github.com","published":"2026-08-04T16:16:29.100","lastModified":"2026-10-23T23:10:00.157","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process  vm2  sandbox. To build that code, they inserted a user-controlled  baseURL  value straight into the JavaScript source, for example  const url = \"${baseURL}/...\"; . The only check on  baseURL  was  isValidURL , but a valid-looking URL can still contain characters that break out of a code string. An authenticated user could craft a  baseURL  that passed this check, closed the surrounding string, and injected their own JavaScript into the sandboxed script (code injection, CWE-94). The  vm2  sandbox runs in the same Node.js process as Flowise and exposes risky dependencies. As a result, the injected code could escape the sandbox and run arbitrary code on the Flowise server as the Flowise process user. Exploitation only requires an authenticated session. The issue is fixed in version 3.1.3, which passes the URL to the sandbox as data instead of inserting it into code and adds stricter URL validation."},{"lang":"es","value":"Flowise es una interfaz de usuario de arrastrar y soltar para construir flujos personalizados de modelos de lenguaje grandes (LLM). Antes de la versión 3.1.3, varios componentes de herramientas personalizadas - AgentAsTool, ChatflowTool y ExecuteFlow - ejecutaban código en la sandbox vm2 en proceso. Para construir ese código, insertaban un valor baseURL controlado por el usuario directamente en el código fuente de JavaScript, por ejemplo const url = ’${baseURL}/...’;. La única verificación en baseURL era isValidURL, pero una URL de apariencia válida aún puede contener caracteres que rompen una cadena de código. Un usuario autenticado podría crear una baseURL que pasara esta verificación, cerrara la cadena circundante e inyectara su propio JavaScript en el script de la sandbox (inyección de código, CWE-94). La sandbox vm2 se ejecuta en el mismo proceso de Node.js que Flowise y expone dependencias riesgosas. Como resultado, el código inyectado podría escapar de la sandbox y ejecutar código arbitrario en el servidor de Flowise como el usuario del proceso de Flowise. La explotación solo requiere una sesión autenticada. El problema está solucionado en la versión 3.1.3, que pasa la URL a la sandbox como datos en lugar de insertarla en el código y añade una validación de URL más estricta."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"FlowiseAI","product":"Flowise","versions":[{"version":"< 3.1.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-05T14:41:59.649092Z","id":"CVE-2026-69253","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-95"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*","versionEndExcluding":"3.1.3","matchCriteriaId":"8C8B3FC2-6070-4400-9690-FCBE0C5C1D37"}]}]}],"references":[{"url":"https://github.com/FlowiseAI/Flowise/commit/3f257bdc8196082a178da7134a075824401b13b9","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/FlowiseAI/Flowise/pull/6417","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wg86-r78f-74mp","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}