Critical · published October 15, 2025
🚨 An authenticated user's tool could become the key to the kingdom! A crafty attacker can exploit a code execution flaw in Flowise versions 3.0.1 to 3.0.8 with 'ALLOW_BUILTIN_DEP' enabled. 🔥 Think of it like a hotel room with a master key—once inside, a guest can tamper with the safe and access the valuables without the staff ever knowing! Here, the attacker can control the browser execution location and bypass the security checks of the Node VM sandbox. This vulnerability allows attackers to execute arbitrary code on the host system. Picture the chaos that could unfold if someone malicious gains control—stealing data, altering configurations, or even installing malware directly on the server. The implications are absolutely devastating!
Think of it like a hotel room with a master key—once inside, a guest can tamper with the safe and access the valuables without the staff ever knowing! Here, the attacker can control the browser execution location and bypass the security checks of the Node VM sandbox. This remote code execution vulnerability arises due to insecure handling of integrated modules (Puppeteer and Playwright) within the Node VM execution environment, allowing attackers to specify executable paths that run with host-level access.
This vulnerability allows attackers to execute arbitrary code on the host system. Picture the chaos that could unfold if someone malicious gains control—stealing data, altering configurations, or even installing malware directly on the server. The implications are absolutely devastating! To secure your systems, upgrade Flowise to version 3.0.8 or later immediately, and consider disabling the 'ALLOW_BUILTIN_DEP' option if it’s currently in use. Additionally, audit your tools that leverage Puppeteer and Playwright for any potential risks. You've got this! With these steps, you're well on your way to locking down your security! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| flowiseai/flowise | ≥ 3.0.1, < 3.0.8 | 3.0.8 |