GHSA-3769-jgqc-cxm7: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
Summary
Flowise contains a sandbox escape vulnerability in the executeJavaScriptCode() function that allows authenticated users to run arbitrary system commands as root. The function uses JavaScript's spread operator to merge user-provided nodeVMOptions with default security settings, letting attackers override the restricted module list and re-enable dangerous modules like child_process (which runs system commands) and fs (which accesses files).
Vulnerability Details
EPSS: 0.0%
Yes
August 4, 2026
Classification
Taxonomy References
Affected Vendors
Affected Packages
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://github.com/advisories/GHSA-3769-jgqc-cxm7
First tracked: August 4, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 85%