GHSA-x3hf-7cj6-3r4m: Flowise RCE via SQLite Record Manager Node
Summary
Flowise AI versions up to 3.1.2 have a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability in the SQLite Record Manager node. An attacker can override the database file path through the `additionalConfig` input and write an SQLite database to arbitrary locations on the system, including sensitive directories, especially dangerous when Flowise runs as root in Docker containers.
Vulnerability Details
EPSS: 0.0%
Yes
August 4, 2026
Classification
Taxonomy References
Affected Vendors
Affected Packages
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://github.com/advisories/GHSA-x3hf-7cj6-3r4m
First tracked: August 4, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 95%