CVE-2026-119978highCode execution2026-10-30
CVE-2026-119978: Flowise through 3.1.4 lets logged-in users escape the custom-function sandbox and run OS commands when ALLOW_BUILTIN_DEP=true
Flowise through 3.1.4 has another vm2 sandbox escape in its custom JavaScript function endpoint. With ALLOW_BUILTIN_DEP=true, an authenticated user can abuse the allowlisted langchain and mammoth modules to write a file into the mammoth package and load it, running OS commands as the Flowise process user. NVD lists no fixed version.
What it is
The endpoint /api/v1/node-custom-function runs user JavaScript inside vm2 with an allowlist of modules.
When ALLOW_BUILTIN_DEP=true, an attacker can use the allowlisted langchain LocalFileStore to write a file into the mammoth package and then require it, escaping vm2 (CWE-749).
The code then runs as the Flowise process user. The attacker needs to be an authenticated Flowise user.
How to check
- Check your Flowise version (3.1.4 and earlier are affected according to NVD).
- Check whether ALLOW_BUILTIN_DEP is set to true in your Flowise environment or docker-compose file.
How to fix
- Set ALLOW_BUILTIN_DEP to false (or remove it) unless you truly need built-in modules in custom functions.
- Limit who can log in to Flowise and keep it off the public internet.
- Watch the Flowise releases for a version that names this CVE as fixed and upgrade when it ships.
# look for the risky setting
grep -rn ALLOW_BUILTIN_DEP .env docker-compose*.yml 2>/dev/nullSources
More advisories for this tool