Database/AI/ML frameworks & serving
Flowise: custom-function sandbox escape gives authenticated users OS command execution
Impact
Flowise runs user-authored JavaScript for LLM flows inside a vm2 sandbox. With ALLOW_BUILTIN_DEP=true, an authenticated user can post JavaScript to /api/v1/node-custom-function that uses LocalFileStore to write a file into the allowlisted mammoth package and then require it, executing outside the sandbox as the Flowise process user. On a shared inference host that means OS command execution with whatever the Flowise service account holds - model files, API keys for upstream model providers, and network reach to the rest of the serving tier. Anyone who can log in and build a flow, which in most deployments is every user of the tool, gets this.
Who can reach it
Any authenticated Flowise user who can submit a custom function, over the network to the Flowise API. Requires ALLOW_BUILTIN_DEP=true; low privilege otherwise.
What to do
No fixed version is named in the record - it reports Flowise affected through 3.1.4. Set ALLOW_BUILTIN_DEP=false and restart the Flowise service, which removes the allowlisted-module path this abuses, and restrict who can author custom functions. Treat the Flowise process credentials as exposed on any instance that ran with the flag on. Patching is a daemon restart, not a node operation.
References
Related entries
- Keras (`utils.get_file`, tar extract): Path traversal on tar extractionCVE-2025-12060 · Keras (`utils.get_file`, tar extract)High
- llama.cpp (`gguf_init_from_file_impl`): Integer overflow in GGUF initCVE-2025-53630 · llama.cpp (`gguf_init_from_file_impl`)High
- Pure Storage FlashArray VASA provider: A vSphere or ESXi administrator with VASA access to a FlashArray escalates toCVE-2023-36628 · Pure Storage FlashArray VASA providerHigh
- LangChain (recursive URL loader): SSRF — crawling proceeds to internal hostsCVE-2023-46229 · LangChain (recursive URL loader)High
- llama.cpp / GGUF library: Heap buffer overflow in GGUF `infoCVE-2024-21802 · llama.cpp / GGUF libraryHigh
- llama.cpp / GGUF: Heap overflow in `GGUF_TYPE_ARRAY`/`GGUF_TYPE_STRING` parsingCVE-2024-21825 · llama.cpp / GGUFHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.