By With the plethora of LLMs and AI products available today, it is not uncommon for developers to be subscribed to multiple services at once. Although these services can be very powerful individually, stringing them together into a single, coherent workflow is often anything but straightforward. So it came as no surprise to us thatFlowisehas become one of the top GitHub repositories in this space. Flowise advertises itself as a "generative AI development platform for building AI Agents and LLM workflows".It offers a self-hosted option, as well as a cloud/enterprise plan where users can pay for support and additional enterprise features such as multiple workspaces. Imagine our surprise when we navigated to Flowise'ssecurity advisorieson GitHub and saw that it was full of high and critical vulnerabilities. As we reviewed these advisories, our curiosity was piqued even further, and we decided to spend some time reviewing the codebase as well. Most of the patched issues were of high or critical severity, and the technical details behind them were alarming. For example,CVE-2025-58434described how the password reset flow allowed account takeovers.This was due to its original implementation sending the password reset token in the response when requesting a password reset token for an email address of a registered user. Then there are also multiple instances where user input was executed as pure JavaScript, as seen in:CVE-2025-59434,CVE-2025-59528,GHSA-7944-7c6r-55vv, and many more. There were also account-related issues, which can be used as part of an exploit chain. For example, thepassword change featuredid not require the user to re-enter their password.Theemail change featurealso had a similar issue. Flowise's custom Model Context Protocol (MCP) node has also been associated with multiple prior Remote Code Execution (RCE) vulnerabilities, includingCVE-2026-40933,CVE-2026-41268,CVE-2025-59528, andGHSA-6933-jpx5-q87q. These issues reflect a broader, systemic problem across the AI industry involving the insecure use ofstdioMCP servers, as discussed inthis analysis. Having reviewed all the low-hanging fruit covered thus far, we were determined to sweep the codebase for further vulnerabilities, with a particular focus on identifying Remote Code Execution (RCE) issues. After diving into this massive codebase, we were able to identify 6 more ways to achieve RCE in Flowisev3.1.1andv3.1.2. As we were writing up this post after having our submissions accepted, Flowisepublisheda batch of vulnerabilities that were reported by ZDI and other researchers. These were vulnerabilities that affected versions prior to3.1.0. Interestingly,CVE-2026-41264was an RCE vulnerability in theCSVAgentnode, which was what we reported as well. This meant that the patch was insufficient, and we were able to find additional vectors to exploit the issue in the patched version. CVE-2025-26319describes a sandbox escape vulnerability regarding the use ofFlowise'snodevm, a fork of the insecurevm2sandbox, that was achieved by abusing thepuppeteerandplaywrightmodules that were permitted within the sandbox.Flowise's remediation restricted allowed external modules tonode-fetch,axios, andmomentby default. However, we were able to bypass the sandbox again by exploiting themomentvulnerabilityCVE-2022-24785, as its patch is insufficient within a sandboxed execution context. CVE-2026-41268exploited the configuration of a Flowise Custom MCP node to inject aNODE_OPTIONSenvironment variable for a spawnednodeprocess.A part of Flowise's patch was to includeNODE_OPTIONSin a denylist validation check, but from ourprevious research into hacking with environment variableswe knew this validation check was not sufficient, and we were able to exploit the same node to achieve RCE again. The other three RCE vulnerabilities we reported were novel and did not have previously documented variants. We identified multiple instances where Flowise permitted users to supply arbitrary options when initialising theTypeORMDataSourceclass, enabling exploitation of parameters such asentitiesto load and execute arbitrary JavaScript code. The SQL Database Chain and SQLite Record Manager nodes also allowed users to write a SQLite database to an arbitrary file path. We exploited this capability to create a polyglot shell script that was subsequently executed bychromiumwhen launched viapuppeteer. The following sections provide a technical analysis of all RCE vulnerabilities that we identified in Flowise. You might be wondering whatpandashas to do with this Node.js codebase. As it turns out, there were a few occurrences wherepyodidewas used to run Python code. This is because Flowise allows users to write their ownpandascode to process CSV files, if they choose to. One example is theCSVAgentnode, which can be added to a Chatflow: We observed that when creating aCSVAgentnode in Flowise, there are 2 sources that we can influence: