Zurück zur CVE-Übersicht
CVE-2026-119978
HIGH(8.5)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Risk Signal Score21/100 — NIEDRIG
- CVSS 8.5 — Hoch
Erwähnungen (letzte 60 Tage)
Artikel
EPSS-Score
0.3%
Exploit-Wahrscheinlichkeit (30 Tage)
CVSS Score
8.5
Technische Schwere
Beschreibung
Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth package via LocalFileStore and requires it, escaping vm2 as the Flowise process user.
Referenzen
- https://github.com/FlowiseAI/Flowise
- https://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c...
- https://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c...
- https://github.com/advisories/GHSA-9gvv-qjj3-2p6g
- https://github.com/soovwv/cve/blob/a37354aff1e78c0601772e7716f5318c473e8640/CVE-...
- https://www.vulncheck.com/advisories/flowise-through-3.1.4-custom-function-sandb...