This vulnerability allows an authenticated user to execute arbitrary OS commands by uploading JavaScript to the /api/v1/node-custom-function endpoint. The attacker abuses the allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true, writing a file into the mammoth package through LocalFileStore and requiring it. This bypasses the vm2 sandbox and runs commands as the Flowise process user. The impact is full integrity and confidentiality compromise, enabling a local or remote attacker with legitimate credentials to run any system command on the host.

The affected product is Flowise AI’s Flowise application, versions up through 3.1.4. The vulnerability hinges on configurations that permit built‑in dependencies, so all installations that enable ALLOW_BUILTIN_DEP=true and expose the node‑custom‑function API to authenticated users are impacted.

The CVSS score of 9 indicates critical severity, and the vulnerability is known to be exploitable by authenticated users. The EPSS score is not available, but the lack of available exploit data does not mitigate the risk due to the high CVSS. The vulnerability is not listed in CISA KEV, yet the ability to execute arbitrary commands on the Flowise host poses a substantial threat. An attacker requires authentication but can then execute arbitrary OS commands, potentially compromising the entire system.