CVE-2026-119978

Flowise custom functions escape through writable dependency files

FlowiseAI · Flowise custom-function sandbox

First documented disclosure · Review checkpoint

Summary

An authenticated custom function can reach host command execution.

Severity and exploitation evidence

Critical · 9.0/10 · CVSS 4.0. Severity source.

Exploitation not established: CNA technical disclosure; malicious exploitation and affected-victim counts are not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

With built-in dependencies enabled, an allowlisted file store writes a loadable file into another permitted package.

Conditions required

Custom-function API access, ALLOW_BUILTIN_DEP=true and write access to the targeted package path.

Potential impact

Commands run as the Flowise process, exposing its data and credentials.

Affected versions and configurations

Through 3.1.4 according to VulnCheck.

Fix and mitigation status

No issue-specific fixed release verified.

Practical next steps

Disable built-in dependencies where possible, restrict custom-function access and make dependencies read-only pending a verified fix.

Operating lesson

A module allowlist is insufficient when another allowed module can rewrite those modules.

Evidence and limits

The cited GHSA-9gvv-qjj3-2p6g maps to different CVE-2026-73483. Its October 7 date and 3.1.3 fix do not resolve this LocalFileStore issue.

Sources