CVE-2026-69253

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-69253", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-03T19:54:19.853Z", "datePublished": "2026-08-04T15:13:39.181Z", "dateUpdated": "2026-08-05T14:42:10.411Z"}, "containers": {"cna": {"title": "Flowise Sandbox Escape to RCE", "problemTypes": [{"descriptions": [{"cweId": "CWE-95", "lang": "en", "description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wg86-r78f-74mp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wg86-r78f-74mp"}, {"name": "https://github.com/FlowiseAI/Flowise/pull/6417", "tags": ["x_refsource_MISC"], "url": "https://github.com/FlowiseAI/Flowise/pull/6417"}, {"name": "https://github.com/FlowiseAI/Flowise/commit/3f257bdc8196082a178da7134a075824401b13b9", "tags": ["x_refsource_MISC"], "url": "https://github.com/FlowiseAI/Flowise/commit/3f257bdc8196082a178da7134a075824401b13b9"}, {"name": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"}], "affected": [{"vendor": "FlowiseAI", "product": "Flowise", "versions": [{"version": "< 3.1.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-04T15:13:39.181Z"}, "descriptions": [{"lang": "en", "value": "Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to version 3.1.3, several custom-tool components \u2014 AgentAsTool, ChatflowTool, and ExecuteFlow \u2014 ran code in the in-process \u00a0vm2\u00a0 sandbox. To build that code, they inserted a user-controlled \u00a0baseURL\u00a0 value straight into the JavaScript source, for example \u00a0const url = \"${baseURL}/...\";\u00a0. The only check on \u00a0baseURL\u00a0 was \u00a0isValidURL\u00a0, but a valid-looking URL can still contain characters that break out of a code string. An authenticated user could craft a \u00a0baseURL\u00a0 that passed this check, closed the surrounding string, and injected their own JavaScript into the sandboxed script (code injection, CWE-94). The \u00a0vm2\u00a0 sandbox runs in the same Node.js process as Flowise and exposes risky dependencies. As a result, the injected code could escape the sandbox and run arbitrary code on the Flowise server as the Flowise process user. Exploitation only requires an authenticated session. The issue is fixed in version 3.1.3, which passes the URL to the sandbox as data instead of inserting it into code and adds stricter URL validation."}], "source": {"advisory": "GHSA-wg86-r78f-74mp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T14:41:59.649092Z", "id": "CVE-2026-69253", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T14:42:10.411Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-69253", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T14:41:59.649092Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T14:42:06.154Z"}}], "cna": {"title": "Flowise Sandbox Escape to RCE", "source": {"advisory": "GHSA-wg86-r78f-74mp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "FlowiseAI", "product": "Flowise", "versions": [{"status": "affected", "version": "< 3.1.3"}]}], "references": [{"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wg86-r78f-74mp", "name": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wg86-r78f-74mp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/FlowiseAI/Flowise/pull/6417", "name": "https://github.com/FlowiseAI/Flowise/pull/6417", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/FlowiseAI/Flowise/commit/3f257bdc8196082a178da7134a075824401b13b9", "name": "https://github.com/FlowiseAI/Flowise/commit/3f257bdc8196082a178da7134a075824401b13b9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3", "name": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to version 3.1.3, several custom-tool components \u2014 AgentAsTool, ChatflowTool, and ExecuteFlow \u2014 ran code in the in-process \u00a0vm2\u00a0 sandbox. To build that code, they inserted a user-controlled \u00a0baseURL\u00a0 value straight into the JavaScript source, for example \u00a0const url = \"${baseURL}/...\";\u00a0. The only check on \u00a0baseURL\u00a0 was \u00a0isValidURL\u00a0, but a valid-looking URL can still contain characters that break out of a code string. An authenticated user could craft a \u00a0baseURL\u00a0 that passed this check, closed the surrounding string, and injected their own JavaScript into the sandboxed script (code injection, CWE-94). The \u00a0vm2\u00a0 sandbox runs in the same Node.js process as Flowise and exposes risky dependencies. As a result, the injected code could escape the sandbox and run arbitrary code on the Flowise server as the Flowise process user. Exploitation only requires an authenticated session. The issue is fixed in version 3.1.3, which passes the URL to the sandbox as data instead of inserting it into code and adds stricter URL validation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-95", "description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-04T15:13:39.181Z"}}}, "cveMetadata": {"cveId": "CVE-2026-69253", "state": "PUBLISHED", "dateUpdated": "2026-08-05T14:42:10.411Z", "dateReserved": "2026-08-03T19:54:19.853Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-04T15:13:39.181Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Flowise", "vendor": "FlowiseAI", "versions": [{"status": "affected", "version": "< 3.1.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*", "matchCriteriaId": "8C8B3FC2-6070-4400-9690-FCBE0C5C1D37", "versionEndExcluding": "3.1.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to version 3.1.3, several custom-tool components \u2014 AgentAsTool, ChatflowTool, and ExecuteFlow \u2014 ran code in the in-process \u00a0vm2\u00a0 sandbox. To build that code, they inserted a user-controlled \u00a0baseURL\u00a0 value straight into the JavaScript source, for example \u00a0const url = \"${baseURL}/...\";\u00a0. The only check on \u00a0baseURL\u00a0 was \u00a0isValidURL\u00a0, but a valid-looking URL can still contain characters that break out of a code string. An authenticated user could craft a \u00a0baseURL\u00a0 that passed this check, closed the surrounding string, and injected their own JavaScript into the sandboxed script (code injection, CWE-94). The \u00a0vm2\u00a0 sandbox runs in the same Node.js process as Flowise and exposes risky dependencies. As a result, the injected code could escape the sandbox and run arbitrary code on the Flowise server as the Flowise process user. Exploitation only requires an authenticated session. The issue is fixed in version 3.1.3, which passes the URL to the sandbox as data instead of inserting it into code and adds stricter URL validation."}, {"lang": "es", "value": "Flowise es una interfaz de usuario de arrastrar y soltar para construir flujos personalizados de modelos de lenguaje grandes (LLM). Antes de la versi\u00f3n 3.1.3, varios componentes de herramientas personalizadas - AgentAsTool, ChatflowTool y ExecuteFlow - ejecutaban c\u00f3digo en la sandbox vm2 en proceso. Para construir ese c\u00f3digo, insertaban un valor baseURL controlado por el usuario directamente en el c\u00f3digo fuente de JavaScript, por ejemplo const url = \u2019${baseURL}/...\u2019;. La \u00fanica verificaci\u00f3n en baseURL era isValidURL, pero una URL de apariencia v\u00e1lida a\u00fan puede contener caracteres que rompen una cadena de c\u00f3digo. Un usuario autenticado podr\u00eda crear una baseURL que pasara esta verificaci\u00f3n, cerrara la cadena circundante e inyectara su propio JavaScript en el script de la sandbox (inyecci\u00f3n de c\u00f3digo, CWE-94). La sandbox vm2 se ejecuta en el mismo proceso de Node.js que Flowise y expone dependencias riesgosas. Como resultado, el c\u00f3digo inyectado podr\u00eda escapar de la sandbox y ejecutar c\u00f3digo arbitrario en el servidor de Flowise como el usuario del proceso de Flowise. La explotaci\u00f3n solo requiere una sesi\u00f3n autenticada. El problema est\u00e1 solucionado en la versi\u00f3n 3.1.3, que pasa la URL a la sandbox como datos en lugar de insertarla en el c\u00f3digo y a\u00f1ade una validaci\u00f3n de URL m\u00e1s estricta."}], "id": "CVE-2026-69253", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69253", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T14:41:59.649092Z", "version": "2.0.3"}}]}, "published": "2026-08-04T16:16:29.100", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/FlowiseAI/Flowise/commit/3f257bdc8196082a178da7134a075824401b13b9"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/FlowiseAI/Flowise/pull/6417"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wg86-r78f-74mp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-95"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.1.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Flowise", "source": "cna", "vendor": "FlowiseAI"}, "product": "flowise", "vendor": "flowiseai"}], "created": "2026-08-04T17:00:12.351830+00:00", "updated": "2026-08-04T19:45:03.533228+00:00", "vendors": ["flowiseai", "flowiseai$PRODUCT$flowise"], "weaknesses": ["CWE-95"]}