PT-2025-42175 · Flowise+2 · Flowise+2
Cale Black
·
Published
2025-10-14
·
Updated
2025-10-15
·
CVE-2025-34267
CVSS v3.1
9.9
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Flowise versions 3.0.1 through 3.0.7
Flowise versions 3.0.8 and later with 'ALLOW BUILTIN DEP' enabled
Description
The software contains an authenticated remote code execution issue and a node VM sandbox escape. This is due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execution environment. An authenticated attacker who can create or run a tool leveraging Puppeteer/Playwright can specify attacker-controlled browser binary paths and parameters. When the tool executes, these attacker-controlled elements are run on the host, bypassing the nodevm sandbox restrictions and allowing for arbitrary code execution in the host's context. The developers initially misidentified this as a duplicate of another issue.
Recommendations
Update to Flowise version 3.0.8 or later and ensure 'ALLOW BUILTIN DEP' is disabled.
For versions prior to 3.0.8, consider restricting access to tools that leverage Puppeteer/Playwright.
Exploit
Fix
RCE
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Flowise
Playright
Puppeteer