CVE-2026-52098

Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass.

Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection.

A vulnerability in Flowise (up to 3.1.4) in the OpenAI Assistants integration allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID without workspace ownership verification.

Flowise prior to 3.1.3 contains a vulnerability in the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint, which is in WHITELIST_URLS and requires no authentication. An attacker with a credential ID can refresh the OAuth token and gain access to the victim's connected service, as well as exhaust refresh-token quota.

Flowise before version 3.1.3 contains a prompt injection vulnerability in the CSV Agent node, allowing a malicious Python script to bypass the blocklist validator and execute in an unsandboxed Pyodide environment. An attacker can leverage this to execute arbitrary code in the context of the service account.

Flowise prior to 3.1.3 contains a vulnerability in the Python code validator that can be bypassed with Unicode homoglyphs, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host.

Flowise prior to 3.1.3 contains a vulnerability in CSVAgent that allows an attacker to inject code into a Python template executed by Pyodide, enabling arbitrary OS command execution on the Flowise host. An unauthenticated request to the API can trigger remote code execution.

Flowise prior to 3.1.3 contains a vulnerability in the SQLite Record Manager node that allows an authenticated attacker to overwrite the SQLite database path and place malicious syntax in a configuration file, potentially leading to code execution when Chromium is launched.

Flowise prior to 3.1.3 contains a vulnerability in the CSVAgent node that allows an authenticated user to execute arbitrary code by deserializing a malicious pickle payload, bypassing the denylist of dangerous Python constructs.

Flowise before version 3.1.3 has a vulnerability in the CSVAgent component where attacker-controlled CSV data is directly interpolated into Python code executed by Pyodide. An authenticated attacker can inject Python code that uses Pyodide's js bridge to load child_process and execute arbitrary system commands as root in the Flowise container.