CVE-2026-119978 FlowiseAI CVE debrief

Who should care

Administrators and users of Flowise instances, particularly those with authenticated access to the `/api/v1/node-custom-function` endpoint, should assess exposure and prioritize updating to version 3.1.3 or later.

Why it matters

CVE-2026-119978 allows an authenticated user to escape the sandbox in Flowise versions <= 3.1.2, potentially leading to remote code execution and file disclosure. Defenders should prioritize updating to version 3.1.3 or later and restrict access to the `/api/v1/node-custom-function` endpoint.

• Authenticated remote code execution as the Flowise process user
• Arbitrary host file disclosure via Chromium's `file://` URL handling
• Potential for lateral movement and further exploitation

Technical summary

Flowise versions <= 3.1.2 contain a sandbox escape in the `vm2/@flowiseai/nodevm` JavaScript sandbox. An authenticated user with access to the `/api/v1/node-custom-function` endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. This allows execution of arbitrary OS commands as the Flowise process user (root in the official Docker image) and arbitrary host file disclosure via Chromium's `file://` URL handling.

Defensive priority

High

Recommended defensive actions

• Review and update Flowise to version 3.1.3 or later
• Restrict access to the /api/v1/node-custom-function endpoint
• Monitor for suspicious activity on the Flowise instance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability in Flowise versions <= 3.1.2, which allows an authenticated user to escape the sandbox and execute arbitrary OS commands as the Flowise process user. The source item also mentions that the vulnerability is fixed in version 3.1.3.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.