{"id":"EUVD-2026-114243","enisaUuid":"b9f17860-70d1-3f7b-b60c-e13990050ce6","description":"Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP\u003dtrue. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth package via LocalFileStore and requires it, escaping vm2 as the Flowise process user.","datePublished":"Oct 30, 2026, 5:28:31 PM","dateUpdated":"Nov 6, 2026, 4:33:02 PM","baseScore":9.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/soovwv/cve/blob/a37354aff1e78c0601772e7716f5318c473e8640/CVE-2026-119978.md\nhttps://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c95/packages/components/src/utils.ts#L55-L114\nhttps://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c95/packages/components/src/utils.ts#L1733\nhttps://github.com/advisories/GHSA-9gvv-qjj3-2p6g\nhttps://github.com/FlowiseAI/Flowise\nhttps://www.vulncheck.com/advisories/flowise-through-3.1.4-custom-function-sandbox-escape-rce-via-localfilestore\n","aliases":"CVE-2026-119978\nGHSA-7pc2-8w3w-pqfg\n","assigner":"VulnCheck","epss":0.34,"enisaIdProduct":[{"id":"94e94568-2959-3c15-be6d-d9932b6b0168","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"0 ≤3.1.4"}],"enisaIdVendor":[{"id":"73217de4-3c16-3247-966f-fc4abedaabbb","vendor":{"name":"FlowiseAI"}}],"enisaIdVulnerability":[{"id":"b1c1cb74-afda-3ec4-b8a7-cfcc01646629","vulnerability":{"id":"GHSA-7pc2-8w3w-pqfg","description":"Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP\u003dtrue. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth package via LocalFileStore and requires it, escaping vm2 as the Flowise process user.","datePublished":"Oct 30, 2026, 6:32:44 PM","dateUpdated":"Nov 2, 2026, 9:31:44 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-119978\nhttps://github.com/FlowiseAI/Flowise\nhttps://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c95/packages/components/src/utils.ts#L1733\nhttps://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c95/packages/components/src/utils.ts#L55-L114\nhttps://github.com/advisories/GHSA-9gvv-qjj3-2p6g\nhttps://github.com/soovwv/cve/blob/a37354aff1e78c0601772e7716f5318c473e8640/CVE-2026-119978.md\nhttps://www.vulncheck.com/advisories/flowise-through-3.1.4-custom-function-sandbox-escape-rce-via-localfilestore\n","enisa_id":"EUVD-2026-114243\n","aliases":"CVE-2026-119978\nGHSA-7pc2-8w3w-pqfg\n","epss":0.0,"dataProcessed":"Nov 10, 2026, 7:06:18 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"bf26155d-a7bf-3ae6-9f7e-42b18a95482b","vulnerability":{"id":"CVE-2026-119978","description":"Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP\u003dtrue. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth package via LocalFileStore and requires it, escaping vm2 as the Flowise process user.","datePublished":"Oct 30, 2026, 5:28:31 PM","dateUpdated":"Nov 6, 2026, 4:33:02 PM","status":"PUBLISHED","baseScore":9.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/soovwv/cve/blob/a37354aff1e78c0601772e7716f5318c473e8640/CVE-2026-119978.md\nhttps://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c95/packages/components/src/utils.ts#L55-L114\nhttps://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c95/packages/components/src/utils.ts#L1733\nhttps://github.com/advisories/GHSA-9gvv-qjj3-2p6g\nhttps://github.com/FlowiseAI/Flowise\nhttps://www.vulncheck.com/advisories/flowise-through-3.1.4-custom-function-sandbox-escape-rce-via-localfilestore\n","enisa_id":"EUVD-2026-114243\n","assigner":"VulnCheck","epss":0.34,"dataProcessed":"Nov 10, 2026, 7:37:26 AM","vulnerabilityProduct":[{"id":"b9e4efc0-4357-3163-9617-da80aa767aba","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"0 ≤3.1.4"}],"vulnerabilityVendor":[{"id":"78dfa152-a299-3eb3-b372-8515624756e5","vendor":{"name":"FlowiseAI"}}]}}],"enisaIdAdvisory":[]}