Sign in
Deutsch English Español Polski
High

Flowise OverrideConfig security vulnerability

  • Disclosed: 21.11.2024
  • Updated: 11.10.2026 10:22

Impact

Flowise allows developers to inject configuration into the Chainflow during execution through the overrideConfig option. This is supported in both the frontend web integration and the backend Prediction API.

This has a range of fundamental issues that are a major security vulnerability. While this feature is intentional, it should have strong protections added and be disabled by default.

These issues include:

  1. Remote code execution. While inside a sandbox this allows for
  2. Sandbox escape
  3. DoS by crashing the server
  4. SSRF
  5. Prompt Injection, both System and User
  6. Full control over LLM prompts
  7. Server variable and data exfiltration And many many more such as altering the flow of a conversation, prompt exfiltration via LLM proxying etc.

These issues are self-targeted and do not persist to other users but do leave the server and business exposed. All issues are shown with the API but also work with the web embed.

Workarounds

  • overrideConfig should be disabled by default
  • overrideConfig should have an explicit allow list of variables that are allowed to be modified. This way the user opts-in to where modifications can be made.
  • vm2 and any forks of it should be removed as in the authors own words, "fixing the vulnerability seems impossible". The recommended replacement is https://www.npmjs.com/package/isolated-vm

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package flowise < 2.1.4 2.1.4

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE)
CWE-15
Platform
npm
Package
flowise
Disclosed
21.11.2024
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-5cph-wvm9-45gj - CC BY 4.0

Vulnerability history: flowise

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (114) in the archive
Total entries
114
First → latest
04.2024 10.2026
Without a fix
16
Exploited in attacks
0

Severity breakdown

  • Critical 28
  • High 62
  • Medium 24

Disclosures per year

Severity:
  1. Flowise OverrideConfig security vulnerability this entry
    High CVE-2024-58351 < 2.1.4 2.1.4
  2. Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
    Critical CVE-2026-73487 < 3.1.3 3.1.3
  3. Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
    Critical CVE-2026-73483 < 3.1.3 3.1.3
  4. Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
    Critical CVE-2026-70478 < 3.1.3 3.1.3
  5. Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
    Critical CVE-2026-70477 < 3.1.3 3.1.3
  6. Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
    High CVE-2026-70476 < 3.1.3 3.1.3
  7. Flowise: Missing Authorization on Execution Update Endpoint
    High CVE-2026-70475 < 3.1.3 3.1.3
  8. Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
    High CVE-2026-70474 < 3.1.3 3.1.3
  9. Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
    High CVE-2026-70473 < 3.1.3 3.1.3
  10. Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store
    High CVE-2026-70472 < 3.1.3 3.1.3
  11. Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
    Critical CVE-2026-69264 < 3.1.3 3.1.3
  12. Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys
    High ghsa-88pr-878c-24wf < 3.1.3 3.1.3
  13. Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
    High CVE-2026-70471 < 3.1.3 3.1.3
  14. Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
    Critical CVE-2026-70470 < 3.1.3 3.1.3
  15. Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
    High CVE-2026-69263 < 3.1.3 3.1.3
  16. Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type
    High CVE-2026-69262 < 3.1.3 3.1.3
  17. Flowise RCE via SQLite Record Manager Node
    Critical CVE-2026-69259 < 3.1.3 3.1.3
  18. Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API
    High CVE-2026-69258 < 3.1.3 3.1.3
  19. Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses
    High CVE-2026-69257 < 3.1.3 3.1.3
  20. Flowise: Remote Code Execution Vulnerability in CSVAgent
    Critical CVE-2026-69256 < 3.1.3 3.1.3
  21. Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
    Critical CVE-2026-69255 < 3.1.3 3.1.3
Show more (20) Showing 21 of 90

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.