CVE-2026-69251

Flowise, an open-source drag-and-drop UI for building LLM workflows, allowed authenticated users to pass arbitrary TypeORM DataSource options through the additionalConfig input in its record manager nodes (MySQL, Postgres, SQLite) and agent memory nodes. Because TypeORM options such as entities, subscribers, and migrations can load local JavaScript files from the server's filesystem, an attacker who can upload a JavaScript payload can reference it via additionalConfig.entities and have the server execute it, yielding arbitrary code execution. The flaw affects all Flowise versions prior to 3.1.3 and is rated critical (CVSS 4.0: 9.0), though it requires an authenticated account and a prior file upload. Any organization running a self-hosted Flowise instance with multi-user or weakly protected access is affected. A public security advisory with technical details exists, EPSS estimates a 1.7% chance of exploitation within 30 days, and no in-the-wild exploitation or KEV listing has been reported yet.

What to do: Upgrade Flowise to version 3.1.3 or later, which removes the ability to set dangerous TypeORM options via additionalConfig. Ensure authentication is enabled and tightly controlled, avoid exposing self-hosted instances directly to the internet (place behind VPN/reverse proxy with access controls), and restrict who can upload files or edit record manager/agent memory nodes. Review existing servers for unexpected uploaded JavaScript files and audit additionalConfig entries in saved flows for suspicious entities/migrations/subscribers paths.