A flaw in Flowise allows an authenticated user to submit arbitrary JavaScript code to a custom function endpoint that runs inside a NodeVM sandbox. Because the sandbox can be escaped, the attacker can access the host process object and execute system commands. This vulnerability is identified as a code injection flaw (CWE‑94) and results in the attacker gaining full control of the Flowise server.

The affected products are FlowiseAI’s Flowise platform, specifically any deployment running a version older than 3.1.2 that uses the /api/v1/node-custom-function endpoint without route‑level authorization and without an E2B_APIKEY configured. Users with API keys or authenticated sessions are able to exercise this endpoint.

The CVSS score of 9.4 highlights a severe severity, and while the EPSS score is not available, the lack of a KEV listing indicates no known public exploitation yet. Nevertheless, an attacker with legitimate credentials can exploit the sandbox escape to run arbitrary code on the host. The vulnerability is exploitable in a normal deployment scenario where E2B_APIKEY is not set, making the risk high for typical users. Updating to the patched version removes the unprotected route and secures the sandbox.