Flowise: custom-function sandbox escape via puppeteer.launch gives command execution as the Flowise user

Impact

An authenticated Flowise user who can reach the custom-function endpoint escapes the JavaScript sandbox by passing an attacker-chosen executablePath and args to puppeteer.launch(), which reaches child_process.spawn() outside the sandbox boundary. That yields arbitrary OS command execution as the Flowise process user - root in the official Docker image - plus arbitrary host file reads through Chromium's file:// handling. Flowise instances typically hold API keys for model providers, vector stores and internal services, so the escape hands over the whole credential set of the flow-building tier, not just one tenant's chatflow. Versions 3.0.8 through 3.1.2 need ALLOW_BUILTIN_DEP=true for this to work; anything earlier is exploitable in the default configuration.

Who can reach it

Any authenticated Flowise user with access to /api/v1/node-custom-function, reachable over the network. Low-privilege authentication is required; no admin role is mentioned in the advisory.

What to do

Upgrade to Flowise 3.1.3 and restart the service - image bump and container restart. If you are on 3.0.8-3.1.2 and cannot upgrade immediately, unset ALLOW_BUILTIN_DEP, which the advisory says is required for exploitation on those versions; on earlier versions there is no such switch and upgrading is the only fix. Do not run Flowise as root, and rotate provider and datastore credentials held by any instance that untrusted users could log into.

References

Related entries

• TensorFlow / Keras: Arbitrary code execution via unsafe YAML deserialization of model configCVE-2021-37678 · TensorFlow / KerasCritical
• MLflow (tracking server): Path traversal (`\..\filename`)CVE-2023-1177 · MLflow (tracking server)Critical
• Ray (dashboard /static/ file handler): Path traversal under the dashboard's /static/ route lets an unauthenticatedCVE-2023-6020 · Ray (dashboard /static/ file handler)Critical
• MLflow (LFI via URI parsing): Local file inclusion — read arbitrary filesCVE-2024-3573 · MLflow (LFI via URI parsing)Critical
• Milvus: Unauthenticated attacker exploits the server directlyCVE-2025-64513 · MilvusCritical
• OpenShift AI guardrails-detectors: unauthenticated blind SSRF and file read via crafted XSDCVE-2026-15378 · Red Hat OpenShift AI guardrails-detectors (XSD schema parsing)Critical