Flowise versions up to 3.1.2 allow an authenticated user with access to the /api/v1/node-custom-function endpoint to escape the JavaScript sandbox by supplying custom executablePath and args parameters to puppeteer.launch. The underlying child_process.spawn() call occurs outside the sandbox, enabling arbitrary OS command execution as the user running the Flowise process (root in the official Docker image) and permitting host file disclosure through Chromium's file:// URL handling. This flaw satisfies CWE-78: Improper Neutralization of Special Elements used in an OS Command. The consequence is complete compromise of confidentiality, integrity, and availability of the host system.

The affected products are FlowiseAI Flowise (packages flowise and flowise-components) in all releases up to and including 3.1.2. Versions 3.0.8 to 3.1.2 require the environment variable ALLOW_BUILTIN_DEP=true to be set for exploitation; earlier releases are vulnerable by default. Version 3.1.3 and later contain the fix.

The CVSS score of 9.4 indicates critical severity, though the EPSS score is not available and it is not listed in the CISA KEV catalog. An attacker must be an authenticated user with permissions to call the relevant endpoint and must execute in an environment where ALLOW_BUILTIN_DEP=true is set (or within older vulnerable releases). Because the Flowise Docker image runs as root, successful exploitation results in root-level command execution on the host, making the risk exceptionally high. The likely attack vector is a credentialed web API call to /api/v1/node-custom-function that supplies malicious arguments to puppeteer.launch.