Flowise NodeVM Sandbox Escape Enables Root RCE (CVE-2026-69254)

A published GitHub Security Advisory (GHSA-3769-jgqc-cxm7, CVE-2026-69254) describes a sandbox escape in Flowise's executeJavaScriptCode() function. According to the advisory, the function merges caller-supplied nodeVMOptions over its secure defaults using a JavaScript spread operator ({ ...defaultNodeVMOptions, ...nodeVMOptions }), which lets a caller override the NodeVM module allowlist and re-enable blocked Node.js built-ins such as child_process and fs. A public proof-of-concept reportedly chains this by requiring the Flowise components module by absolute path from inside the sandbox, calling executeJavaScriptCode() again with nodeVMOptions: { require: { builtin: ["*"] } }, and then invoking child_process to run commands as root.

Why It Matters

Per the advisory, any authenticated user holding a valid API key can trigger this via the /api/v1/node-custom-function endpoint — no additional privileges are required. The reported impact is full remote code execution as root, including the ability to read the on-disk encryption key (used to decrypt all stored credentials, OAuth tokens, and database passwords) and the JWT signing secret (which would allow forging authentication for any user), as well as establishing persistence via cron jobs or reverse shells. The advisory states all Flowise deployments running versions >= 3.0.5 through 3.1.1 (the latest at time of writing) are affected. Flowise is an open-source low-code platform for building LLM/agent workflows, so affected instances may be running with elevated trust and access to sensitive integrations.

What Defenders Should Do Now

• Inventory any self-hosted Flowise instances and check the running version against the >= 3.0.5–3.1.1 affected range noted in the advisory; watch for a vendor patch or advisory update.
• Review who holds valid Flowise API keys — the advisory indicates any authenticated caller can reach the vulnerable code path, so treat API key issuance and rotation as a priority control.
• Monitor logs/audit trails for calls to the node-custom-function / custom-function execution endpoints, particularly requests containing nodeVMOptions, require, or references to child_process in the submitted JavaScript payload.
• If Flowise runs in a container, evaluate whether it needs to run as root at all, and consider restricting outbound/host access and file permissions on the encryption key and JWT secret files as defense in depth.
• If compromise is suspected, rotate the encryption key, JWT signing secret, and any credentials stored within Flowise, since the advisory notes both secrets are directly readable via this flaw.

Developing Intel

This is based on a same-day GitHub Security Advisory with a public proof-of-concept; details may be updated as the vendor responds and a patched version is confirmed. See the original advisory for full technical detail and the PoC: GHSA-3769-jgqc-cxm7.