Zero Radar
← feed
CriticalVulnerabilityCVE-2026-119978updated 30 Oct 2026, 22:26 UTC

Flowise: logged-in users can run system commands on the server

Anyone with a Flowise login can slip code past the tool's safety limits and make the server run commands of their choosing. That can give them control of the machine running Flowise.

Official, 2 sources
SeverityCriticalCVSS 9 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Logged-in userAny account with Flowise access
  2. 2Custom function endpointSubmits JavaScript to /api/v1/node-custom-function
  3. 3Mammoth file writeLocalFileStore writes a file into mammoth
  4. 4vm2 sandbox escapeMalicious code requires the planted file
  5. 5OS command executionRuns as the Flowise process user
  6. ResultAttacker runs commands on the server

What happened

Flowise through 3.1.4 has a sandbox escape in the /api/v1/node-custom-function endpoint. When ALLOW_BUILTIN_DEP=true, submitted JavaScript abuses allowlisted langchain and mammoth modules to write a file into the mammoth package via LocalFileStore, require it, and escape vm2 as the Flowise process user.

Why it is dangerous: An authenticated user can execute OS commands as the Flowise process user, which can expose data, credentials and connected systems. Shared or multi-user Flowise deployments are most at risk.

Are you affected?

You are affected if you run Flowise 3.1.4 or earlier with ALLOW_BUILTIN_DEP set to true, and users can log in to it.

Flowise through 3.1.4, when ALLOW_BUILTIN_DEP=true

What to do

  1. Set ALLOW_BUILTIN_DEP to false or remove it from your Flowise configuration
  2. Restrict who has login access to Flowise and remove unused accounts
  3. Check Flowise for an official fixed version and update as soon as one is released
  4. Review server logs for requests to /api/v1/node-custom-function

Timeline

  1. 30 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 30 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 30 Oct 2026, 18:19 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 22:26 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-119978 · GHSA-7pc2-8w3w-pqfg
CVSS
9 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
30 Oct 2026, 18:17 UTC
On Zero Radar
30 Oct 2026, 18:19 UTC (2 min after disclosure)
Last change
30 Oct 2026, 22:26 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Flowise: logged-in users can run system commands on the server · Zero Radar