CVE-2026-69253

Flowise, an open-source drag-and-drop UI for building LLM flows, contains a code injection flaw (CWE-95) in versions prior to 3.1.3 affecting the custom-tool components AgentAsTool, ChatflowTool, and ExecuteFlow. These components interpolated a user-controlled baseURL value directly into JavaScript source executed inside an in-process vm2 sandbox, with only an isValidURL check as validation, so an authenticated user could craft a URL that closed the string literal and injected arbitrary JavaScript. Because the vm2 sandbox runs in the same Node.js process as Flowise and exposes risky dependencies, injected code could escape the sandbox and execute arbitrary code on the Flowise server as the Flowise process user. Only an authenticated session is required, and CVSS 4.0 is rated 9 (critical). The flaw is fixed in version 3.1.3, which passes the URL as data rather than code and adds stricter URL validation; exploitation has not been observed in the wild, though a public advisory documents the issue and EPSS stands at 0.3%.

What to do: Upgrade Flowise to version 3.1.3 or later, where the baseURL is passed to the sandbox as data and URL validation is stricter. Restrict access to Flowise instances with authentication and network-level controls (VPN/reverse proxy), and avoid exposing the UI directly to the internet. Review logs for unusual baseURL values on custom tools (AgentAsTool, ChatflowTool, ExecuteFlow) and investigate for host-level compromise, since successful exploitation yields arbitrary code execution as the Flowise process user.