New Vulnerabilities in Flowise Pose Serious Security Risks for AI Workflows
Recently, six newly identified vulnerabilities in Flowise, an increasingly popular open-source platform designed for the development of AI agents and large language model (LLM) workflows, have come to light. These vulnerabilities grant unauthenticated and low-privileged attackers the alarming capability of achieving remote code execution (RCE) on both self-hosted and cloud-based AI workflow servers that are operating versions of Flowise that have not been updated to address these security issues.
The implications of these flaws are severe; they expose organizations to potential complete server compromise, unauthorized data exfiltration, and even manipulation of AI pipelines. If these vulnerabilities are not addressed in a timely manner, the risks of exploitation could result in devastating consequences for any organization relying on Flowise for their AI operations.
A look into Flowise’s history reveals that the GitHub security advisories have previously documented a range of high and critical issues. Among these were vulnerabilities leading to account takeovers through an insecure password reset flow (identified as CVE‑2025‑58434) and various instances where user-provided input was executed as raw JavaScript (CVE‑2025‑59434, CVE‑2025‑59528, and GHSA‑7944‑7c6r‑55vv). The ongoing security issues highlight a worrying trend regarding the platform’s design and implementation of security protocols.
In a comprehensive review, researchers scrutinizing the codebase of Flowise versions 3.1.1 and 3.1.2 discovered these six additional RCE vectors. Alarmingly, some of these flaws managed to bypass existing patches while others resorted to reusing vulnerable design patterns from prior configurations. It is worth noting that one of the newly identified vulnerabilities bore a striking resemblance to CVE‑2026‑41264, an RCE associated with the CSVAgent node that had been patched in earlier versions, indicating that the original fix had proved insufficient and exploitable in subsequent builds.
The newly discovered vulnerabilities encompass various programming languages including Python, JavaScript, and issues stemming from problematic environment variable usage. Many of these issues stem from user-controlled configuration fields, which had been improperly assumed to be safe during regular workflow setups.
Among the critical vulnerabilities highlighted is a server-side Python execution path that relates to the CSVAgent node, which uses Pyodide for executing user-provided pandas code intended for CSV preprocessing. While Flowise initially tried to secure this feature by implementing a denylist-based validator requiring the code to initiate with a single readcsv call, researchers demonstrated numerous methods for bypassing these controls. These methods included exploiting pandas’ readpickle functionality to deserialize a harmful payload and utilizing pandas.io.common as a vector for attack.
In a practical scenario, an attacker could craft a base64-encoded pickle payload designed to execute a reverse shell command (for instance, using nc) and submit it via the CSVAgent’s "Additional Parameters" field. Upon triggering the chatflow through the prediction API, this could lead to full RCE on the Flowise server.
Another alarming avenue for RCE arises from Flowise’s use of a forked version of the deprecated vm2 sandbox, which executes JavaScript for "Custom Function" operations through the /api/v1/node-custom-function endpoint. Flowise had attempted to mitigate risks by imposing restrictions on certain modules; however, it still permitted the use of libraries such as axios, moment, and node-fetch. Moreover, a vulnerable version of vm2 was in circulation, exposing a direct pathway for malicious sandbox escape.
Even after attempts to fortify the sandbox by disabling vm2 by default, researchers found that new escape methods were still possible. By leveraging the properties of the moment library’s CVE‑2022‑24785, attackers could exploit path traversal behavior inside this sandbox environment, combined with the Flowise document uploader functionality, to execute JavaScript payloads like rce.js from the .flowise/storage directory.
In effect, users should address the presence of vulnerabilities, especially regarding the newly discovered RCE vectors tied to Flowise’s custom Model Context Protocol (MCP) node. This integration facilitates communication with external Model Context Protocol servers by default, thereby allowing unsafe communication methods when the CUSTOMMCPPROTOCOL is set to stdio. Although Flowise has undertaken measures to tackle some of these issues in various pull requests—like removing nodes linked to known problems and implementing new restrictions—the researchers warn that while these updates are helpful, relying on vm2 remains hazardous due to its documented history of escape techniques. They strongly advocate for migrating to more robust isolation methods, especially for multi-tenant AI workflow environments.
To mitigate risks associated with these vulnerabilities, administrators are urged to promptly update Flowise to the latest secure version. It is crucial to audit existing deployments for exposed prediction and node-custom-function endpoints, and to ensure that custom Python/JS execution nodes are either disabled or properly secured. Additionally, enabling CUSTOMMCPPROTOCOL=stdio should be approached with caution, applying strict network and host hardening measures where necessary.
In summary, the discovery of these vulnerabilities presents a stark reminder of the importance of robust security practices in the rapidly evolving landscape of AI tooling. Organizations using Flowise need to take immediate action to protect their workflows and sensitive data from potential exploits.