Advisory · CVE-2026-119978
Flowise sandbox escape via custom function file write
Flowise through 3.1.4 lets authenticated users execute OS commands by abusing allowlisted modules when ALLOW_BUILTIN_DEP is enabled.
- Vendor
- FlowiseAI
- Product
- Flowise
- Identifier / CWE
- CVE-2026-119978
CWE-749 - Action timing
- Immediate
Explain it like I’m five
Flowise lets users run small custom code snippets inside a sandbox, like a playpen. This flaw lets a user smuggle a file into a trusted package and then load it, stepping out of the playpen and running code as Flowise itself.
- 01Authenticated access
An authenticated user reaches the /api/v1/node-custom-function endpoint.
- 02Builtin dependencies enabled
The deployment runs with ALLOW_BUILTIN_DEP set to true, exposing allowlisted langchain and mammoth modules.
- 03File planted
Submitted JavaScript writes a file into the mammoth package via LocalFileStore.
- 04Sandbox escaped
Requiring the planted file escapes vm2 and runs OS commands as the Flowise process user.
What happened
Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth package via LocalFileStore and requires it, escaping vm2 as the Flowise process user. The record rates it high at CVSS 8.5.
No fixed release is stated in the sources checked for this run, so this advisory claims none. The immediate control is configuration: deployments without ALLOW_BUILTIN_DEP enabled do not expose this path, and custom-function access should be limited to trusted users regardless.
What to do
- Inventory Flowise instances and check whether ALLOW_BUILTIN_DEP is enabled.
- Disable ALLOW_BUILTIN_DEP unless it is explicitly required, and restrict custom-function access to trusted users.
- Track the vendor advisory and upgrade to a patched release as soon as the vendor publishes one.
- Review Flowise logs for custom-function submissions and unexpected files inside the mammoth package.
- If exploitation cannot be excluded, treat the host as compromised and rotate credentials reachable from the Flowise process.
Management note
Another Flowise sandbox escape, and the pattern is the point: custom code features in AI builders are a recurring route to host takeover. Keep these instances off public exposure and limit who can submit custom functions, patched or not.