Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to load and execute malicious JavaScript files stored in the document store outside the sandbox.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rqh4-rxw3-93rp Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.0 · flowiseaiNVD modified 2026-10-23 18:10
Affected (CPE criteria) 1
cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*