A vulnerability in Flowise allows an authenticated user to inject arbitrary JavaScript into code that is executed within the vm2 sandbox. User‑controlled baseURL values are inserted directly into a JavaScript string without sufficient escaping, enabling the injection of malicious code. The injected code can escape the sandbox and run as the Flowise process user, providing full control of the server. This results in Remote Code Execution with the privileges of the Flowise service. The weakness is a form of code injection, identified as CWE-95.

The affected product is Flowise by FlowiseAI. Versions prior to 3.1.3 are vulnerable. The issue was addressed in release 3.1.3, which passes the baseURL as data into the sandbox and tightens URL validation. Users running any deployment of Flowise 3.1.2 or earlier are at risk.

The CVSS score of 9 indicates a high‑severity vulnerability. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog. Exploitation requires an authenticated session and the ability to configure custom‑tool components, but otherwise offers complete server compromise. Attackers can target organizations that host Flowise or provide hosted Flowise services, as the vulnerability exists in the code that runs on the server side.