Flowise Critical Vulnerabilities: RCE via Sandbox Escape and Prompt Injection

Two critical vulnerabilities discovered in Flowise versions ≤3.1.2: a NodeVM sandbox escape allowing authenticated remote code execution, and a prompt injection vulnerability in CSV/Airtable agents enabling data exfiltration and SSRF through inadequate Python code validation.

Disclosed 7 October 2026 · Record updated 7 October 2026

Impact

Authenticated users can escape the sandbox and execute arbitrary OS commands as root; unauthenticated users can inject prompts to exfiltrate datasets and perform SSRF attacks via CSV/Airtable agents.

Our coverage

A bird escapes its cage through a crack in the glass while simultaneously a puppeteer's strings tangle, allowing hidden hands to control the marionette from outside.

Vulnerabilities

Two critical flaws in Flowise expose data and allow remote code execution

Researchers disclosed sandbox escape and prompt injection vulnerabilities in Flowise versions up to 3.1.2 on 7 October 2026, with fixes in 3.1.3.

7 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-9gvv-qjj3-2p6g
github.comhttps://github.com/advisories/GHSA-w7x8-q2gp-5cgg