CVE-2026-69259
CriticalCVSS 9.4Summary
Flowise prior to 3.1.3 contains a vulnerability in the SQLite Record Manager node that allows an authenticated attacker to overwrite the SQLite database path and place malicious syntax in a configuration file, potentially leading to code execution when Chromium is launched.
Risk Assessment
The risk includes code execution on the Flowise host, potentially leading to full system compromise, especially when running as root.
Recommendation
It is recommended to upgrade Flowise to version 3.1.3 or later and run the service with restricted privileges.
Original NVD description (English source)
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended database setting, allowing additionalConfig.database to overwrite the SQLite database path. An authenticated attacker using the published Docker image, which ran as root, could write a SQLite database to paths such as /etc/chromium/exploit.conf; by controlling the table name and namespace value, the attacker could place shell syntax into the database file and trigger execution when Puppeteer launched Chromium and sourced /etc/chromium/*.conf. This issue is fixed in version 3.1.3.