{"data":{"id":"7ba8c4df-3b36-4f94-b37d-b1d5ddc2c30c","title":"GHSA-3769-jgqc-cxm7: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override","summary":"Flowise contains a sandbox escape vulnerability in the executeJavaScriptCode() function that allows authenticated users to run arbitrary system commands as root. The function uses JavaScript's spread operator to merge user-provided nodeVMOptions with default security settings, letting attackers override the restricted module list and re-enable dangerous modules like child_process (which runs system commands) and fs (which accesses files).","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-3769-jgqc-cxm7","publishedAt":"2026-08-04T15:29:12.000Z","cveId":"CVE-2026-69254","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["flowise-components@<= 3.1.2 (fixed: 3.1.3)","flowise@<= 3.1.2 (fixed: 3.1.3)"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":true,"disclosureDate":"2026-08-04T15:29:12.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"]}}