LLM frameworks · FlowiseAI
Flowise
Open-source visual builder for AI agents and LLM workflows.
3Advisories
2critical
1high
0medium
2026-10-30Latest
Flowise CVEs & security
Is Flowise safe?
Flowise is an open-source visual builder for AI agents. Its advisories cover sandbox escapes in custom functions and agents that can be prompt-injected through the data they read.
We track 3 security advisories that affect Flowise. By severity: 2 critical and 1 high. All of them have a CVE ID. The most common kind is code execution (2). The newest entry is dated 2026-10-30.
Newest entries on this page
- CVE-2026-119978: Flowise through 3.1.4 lets logged-in users escape the custom-function sandbox and run OS commands when ALLOW_BUILTIN_DEP=true high 2026-10-30
- CVE-2026-73487: Flowise CSV and Airtable agents can be prompt-injected into leaking data and SSRF critical 2026-08-13
- CVE-2026-73483: Flowise custom functions could escape the sandbox through puppeteer.launch() critical 2026-08-13
Using Flowise safely
- Upgrade Flowise to 3.1.3 or later. Both advisories affect 3.1.2 and earlier.
- Don't expose the Flowise UI or API to the internet without authentication.
- Avoid running the container as root, and limit what custom functions can reach.
- Be careful feeding untrusted CSV, Airtable or web content to agents that can make network requests.
Timeline · advisories per quarter
22026 Q3
12026 Q4
Named in sources
Reported for Flowise
01. CVE-2026-73487: Flowise CSV and Airtable agents can be prompt-injected into leaking data and SSRFIn Flowise 3.1.2 and earlier, the CSV Agent and Airtable Agent check LLM-written Python with a regex blocklist that's easy to get around. A prompt sent to the public prediction API can make the agent send the whole dataset to an outside server or reach internal services. Flowise 2026-08-13 02. CVE-2026-73483: Flowise custom functions could escape the sandbox through puppeteer.launch()A logged-in Flowise user who can reach the custom function endpoint could break out of the NodeVM sandbox by passing their own executablePath and args to puppeteer.launch(), running OS commands as the Flowise process, which is root in the official Docker image. Flowise 2026-08-13 03. CVE-2026-119978: Flowise through 3.1.4 lets logged-in users escape the custom-function sandbox and run OS commands when ALLOW_BUILTIN_DEP=trueFlowise through 3.1.4 has another vm2 sandbox escape in its custom JavaScript function endpoint. With ALLOW_BUILTIN_DEP=true, an authenticated user can abuse the allowlisted langchain and mammoth modules to write a file into the mammoth package and load it, running OS commands as the Flowise process user. NVD lists no fixed version. Flowise 
LangChain 2026-10-30
Flowise 2026-08-13 02. CVE-2026-73483: Flowise custom functions could escape the sandbox through puppeteer.launch()A logged-in Flowise user who can reach the custom function endpoint could break out of the NodeVM sandbox by passing their own executablePath and args to puppeteer.launch(), running OS commands as the Flowise process, which is root in the official Docker image. Flowise 2026-08-13 03. CVE-2026-119978: Flowise through 3.1.4 lets logged-in users escape the custom-function sandbox and run OS commands when ALLOW_BUILTIN_DEP=trueFlowise through 3.1.4 has another vm2 sandbox escape in its custom JavaScript function endpoint. With ALLOW_BUILTIN_DEP=true, an authenticated user can abuse the allowlisted langchain and mammoth modules to write a file into the mammoth package and load it, running OS commands as the Flowise process user. NVD lists no fixed version. Flowise LangChain 2026-10-30