CVE-2026-69254

The record

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode() accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching packages/server/src/routes/node-custom-functions/index.ts could run a custom function that imported flowise-components/dist/src/utils.js, called executeJavaScriptCode() again with nodeVMOptions.require.builtin set to allow all built-in modules, and then required child_process to execute arbitrary system commands as root on the Flowise server. This issue is fixed in version 3.1.3.

Affected packages

Related vulnerabilities

• CVE-2026-63378 TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query… CWE-94
• CVE-2026-63346 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-94
• CVE-2026-63345 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-94
• CVE-2026-63344 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-94
• CVE-2026-62853 ThingLinks is an enterprise IoT platform. CWE-94
• CVE-2026-62284 OSAC operator is a Kubernetes operator. CWE-94
• CVE-2026-116852 Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. CWE-94
• CVE-2026-118635 The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory… CWE-94