Flowise: SQLite Record Manager config override gives an authenticated user root code execution in the container

Impact

The SQLite Record Manager node spread user-controlled additionalConfig after the intended database setting, so additionalConfig.database overwrites the SQLite file path. The published Docker image runs as root, so the attacker can drop a SQLite file anywhere on the container filesystem - the reported path is /etc/chromium/exploit.conf - and, by choosing the table name and namespace, place shell syntax inside that file which Chromium's launcher sources when Puppeteer starts it. The result is code execution as root inside the Flowise container. On a GPU node that container typically holds provider API keys, model and vector-store credentials, and, if it was scheduled with GPU resources, the /dev/nvidia* device nodes attached to it. 'Authenticated' is a low bar here: Flowise deployments routinely hand out builder accounts to anyone allowed to compose flows. Fixed in 3.1.3.

Who can reach it

Any authenticated Flowise user who can create or run a flow containing the SQLite Record Manager node, reaching the Flowise UI or API over the network. No administrator role required.

What to do

Upgrade to Flowise 3.1.3, pull the new image and recreate the container or pod - a normal rolling redeploy, no node drain. Separately, stop running the Flowise image as root and drop write access to /etc inside the container, which breaks this class of file-drop-to-execution chain regardless of version.

References

Related entries

• Flowise: custom-function sandbox escape via puppeteer.launch gives command execution as the Flowise userCVE-2026-73483 · Flowise (/api/v1/node-custom-function, vm2/@flowiseai/nodevm sandbox)Critical
• TensorFlow / Keras: Arbitrary code execution via unsafe YAML deserialization of model configCVE-2021-37678 · TensorFlow / KerasCritical
• MLflow (tracking server): Path traversal (`\..\filename`)CVE-2023-1177 · MLflow (tracking server)Critical
• Ray (dashboard /static/ file handler): Path traversal under the dashboard's /static/ route lets an unauthenticatedCVE-2023-6020 · Ray (dashboard /static/ file handler)Critical
• MLflow (LFI via URI parsing): Local file inclusion — read arbitrary filesCVE-2024-3573 · MLflow (LFI via URI parsing)Critical
• Milvus: Unauthenticated attacker exploits the server directlyCVE-2025-64513 · MilvusCritical