Detections
Analytics

SCA: security update for flowise, flowise-components (GHSA-wg86-r78f-74mp)

critical Tenable Self-Hosted Container Security Plugin ID 445639

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior
 to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code
 in the in-process vm2 sandbox. To build that code, they inserted a user-controlled baseURL value straight
 into the JavaScript source, for example const url = "${baseURL}/..."; . The only check on baseURL was
 isValidURL , but a valid-looking URL can still contain characters that break out of a code string. An
 authenticated user could craft a baseURL that passed this check, closed the surrounding string, and
 injected their own JavaScript into the sandboxed script (code injection, CWE-94). The vm2 sandbox runs in
 the same Node.js process as Flowise and exposes risky dependencies. As a result, the injected code could
 escape the sandbox and run arbitrary code on the Flowise server as the Flowise process user. Exploitation
 only requires an authenticated session. The issue is fixed in version 3.1.3, which passes the URL to the
 sandbox as data instead of inserting it into code and adds stricter URL validation. (CVE-2026-69253)

Solution

Update the flowise library and its related packages to version 3.1.3 or later.

See Also

https://github.com/advisories/GHSA-wg86-r78f-74mp

Plugin Details

Severity: Critical

ID: 445639

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/4/2026

Updated: 8/4/2026

Risk Information

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-69253

CVSS v3

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9

Threat Score: 6.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/4/2026

Vulnerability Publication Date: 8/4/2026

Reference Information

CVE: CVE-2026-69253

cwe: CWE-95