Code Injection Vulnerability in Flowise by FlowiseAI

CVE-2026-69253

What is CVE-2026-69253?

Flowise, a user-friendly interface for creating large language models, is susceptible to a code injection vulnerability. This issue arises from the way several custom-tool components handle user-provided URLs. Prior to version 3.1.3, these components inserted user-controlled baseURL values directly into the JavaScript source code, which could allow an authenticated user to manipulate the URL and insert malicious JavaScript code. This injected code could escape the vm2 sandbox, which runs within the same Node.js process, enabling the execution of arbitrary code on the server with the privileges of the Flowise process. The vulnerability has been addressed in version 3.1.3, which now handles URLs more securely by passing them as data and implementing stricter validation.

References