This weakness in Flowise allows an authenticated attacker to supply an arbitrary database path via the SQLite Record Manager node. By writing a malicious SQLite database containing shell expressions to locations such as /etc/chromium/exploit.conf, the attacker can cause Chromium started by Puppeteer to execute those expressions when it reads configuration files. The result is unrestricted code execution on the system where the Flowise Docker image runs.

The vulnerability affects Flowise version 3.1.2 and earlier. The affected product is Flowise AI’s Flowise, specifically the SQLite Record Manager node located in packages/components/nodes/recordmanager/SQLiteRecordManager. Users who deploy the official Flowise Docker image running as root are at risk; other deployments must confirm that the added configuration is not trusted.

The score of 9.4 on the CVSS vector indicates high severity, with local authentication as a prerequisite. EPSS data is not available, and the issue is not listed in CISA KEV. Because the vulnerability requires the attacker to have authenticated access to the Flowise instance and relies on the Docker container executing as root, the attack is feasible in environments where the image is deployed without privilege restrictions or where credentials are compromised.