{"advisories":[{"id":"GHSA-9rvc-vf7m-pgm2","source":"ghsa","title":"FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape","url":"https://github.com/advisories/GHSA-9rvc-vf7m-pgm2"}],"cve":"CVE-2026-46442","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[0,3.1.2)"}}],"enrichment":{"confidence":100.0,"confidence_source":"matching","scores":[{"score":100.0,"source":"matching"}]},"original":{"product":"Flowise","source":"cna","vendor":"FlowiseAI"},"product":"flowise","vendor":"flowiseai"}],"created":"2026-06-08T16:30:06.600244+00:00","updated":"2026-09-24T22:15:17.148796+00:00","vendors":["flowiseai","flowiseai$PRODUCT$flowise"]},"epss":{"score":0.03414},"mitre":{"cpes":[],"created":"2026-06-08T15:30:48.999000+00:00","description":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is not configured — the common deployment case — Flowise executes this code inside a NodeVM sandbox. This sandbox can be escaped, allowing an attacker to reach the host process object and execute system commands via child_process. The result is authenticated remote code execution on the Flowise server host. This issue has been patched in version 3.1.2.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{"score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}},"mitre_repo_path":"cves/2026/46xxx/CVE-2026-46442.json","references":["https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2","https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9rvc-vf7m-pgm2"],"title":"Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape","updated":"2026-06-09T14:35:49.756000+00:00","vendors":[],"weaknesses":["CWE-94"]},"nvd":{"cpes":["cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"],"created":"2026-06-08T16:16:41.347000+00:00","description":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is not configured — the common deployment case — Flowise executes this code inside a NodeVM sandbox. This sandbox can be escaped, allowing an attacker to reach the host process object and execute system commands via child_process. The result is authenticated remote code execution on the Flowise server host. This issue has been patched in version 3.1.2.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"cvssV4_0":{"score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}},"nvd_repo_path":"2026/CVE-2026-46442.json","references":["https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2","https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9rvc-vf7m-pgm2"],"title":null,"updated":"2026-07-23T07:10:00.113000+00:00","vendors":["flowiseai","flowiseai$PRODUCT$flowise"],"weaknesses":["CWE-94"]},"opencve":{"changes":[{"created":"2026-06-08T15:45:00+00:00","data":[{"details":{"new":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is not configured — the common deployment case — Flowise executes this code inside a NodeVM sandbox. This sandbox can be escaped, allowing an attacker to reach the host process object and execute system commands via child_process. The result is authenticated remote code execution on the Flowise server host. This issue has been patched in version 3.1.2.","old":null},"type":"description"},{"details":{"new":"Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape","old":null},"type":"title"},{"details":{"added":["CWE-94"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2","https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9rvc-vf7m-pgm2"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV4_0":{"score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"853b5c1a-11e3-4575-bb0e-d46d3af82b91"},{"created":"2026-06-08T17:00:00+00:00","data":[{"details":["flowiseai","flowiseai$PRODUCT$flowise"],"type":"first_time"},{"details":{"added":["flowiseai","flowiseai$PRODUCT$flowise"],"removed":[]},"type":"vendors"}],"id":"741f4f01-d4f4-4548-ad40-ba05c0153d7e"},{"created":"2026-06-09T15:30:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"poc","Technical Impact":"total"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"fc9654ef-949f-4a60-abfc-7c956ba13341"},{"created":"2026-06-11T04:15:00+00:00","data":[{"details":{"added":["cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":{"cvssV3_1":{"score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"6d4aaa00-12bd-469b-8d81-0c915b518978"}],"cpes":{"data":["cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2026-06-08T15:30:48.999000+00:00","provider":"mitre"},"description":{"data":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is not configured — the common deployment case — Flowise executes this code inside a NodeVM sandbox. This sandbox can be escaped, allowing an attacker to reach the host process object and execute system commands via child_process. The result is authenticated remote code execution on the Flowise server host. This issue has been patched in version 3.1.2.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"provider":"nvd"},"cvssV4_0":{"data":{"score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"},"provider":"mitre"},"epss":{"data":{"score":0.03414},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"poc","Technical Impact":"total"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2","https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9rvc-vf7m-pgm2"],"providers":["mitre","nvd","vulnrichment"]},"title":{"data":"Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape","provider":"mitre"},"updated":{"data":"2026-06-11T04:07:08.640000+00:00","provider":"nvd"},"vendors":{"data":["flowiseai","flowiseai$PRODUCT$flowise"],"providers":["nvd","enrichment"]},"weaknesses":{"data":["CWE-94"],"providers":["mitre","nvd"]}},"vulnrichment":{"cpes":[],"created":"2026-06-08T15:30:48.999000+00:00","description":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is not configured — the common deployment case — Flowise executes this code inside a NodeVM sandbox. This sandbox can be escaped, allowing an attacker to reach the host process object and execute system commands via child_process. The result is authenticated remote code execution on the Flowise server host. This issue has been patched in version 3.1.2.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"poc","Technical Impact":"total"},"version":"2.0.3"}},"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9rvc-vf7m-pgm2"],"title":"Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape","updated":"2026-06-09T14:27:49.544000+00:00","vendors":[],"vulnrichment_repo_path":"2026/46xxx/CVE-2026-46442.json","weaknesses":[]}}