Summary
Flowise custom-tool components could insert an authenticated user's baseURL value directly into JavaScript source executed inside an in-process vm2 sandbox. A crafted value that passed URL validation could break out of the intended string and inject JavaScript, potentially enabling arbitrary code execution on the Flowise server.
Flowise custom-tool components could insert an authenticated user's baseURL value directly into JavaScript source executed inside an in-process vm2 sandbox. A crafted value that passed URL validation could break out of the intended string and inject JavaScript, potentially enabling arbitrary code execution on the Flowise server.
Affected context
The vulnerability occurs in Flowise deployments using the AgentAsTool, ChatflowTool, or ExecuteFlow components before the relevant security fix. It requires a user-controlled baseURL to be incorporated into generated JavaScript source for execution in the vm2 sandbox. Risk is increased where the sandbox has access to sensitive dependencies, environment data, filesystem resources, or process privileges.
The vulnerability occurs in Flowise deployments using the AgentAsTool, ChatflowTool, or ExecuteFlow components before the relevant security fix. It requires a user-controlled baseURL to be incorporated into generated JavaScript source for execution in the vm2 sandbox. Risk is increased where the sandbox has access to sensitive dependencies, environment data, filesystem resources, or process privileges.
Exploit preconditions
- Attack surface: Authenticated Flowise custom-tool and flow configuration functionality
- Required access: A valid authenticated session with permission to configure or invoke the affected components
- Trigger point: Generation and execution of sandboxed JavaScript containing the supplied baseURL
- Why exploitation is possible: URL validation checks format but does not prevent JavaScript string-breaking characters or distinguish data from executable source
- Execution context: The injected code runs in the Flowise Node.js process and may be able to escape the in-process sandbox
- Attack surface: Authenticated Flowise custom-tool and flow configuration functionality
- Required access: A valid authenticated session with permission to configure or invoke the affected components
- Trigger point: Generation and execution of sandboxed JavaScript containing the supplied baseURL
- Why exploitation is possible: URL validation checks format but does not prevent JavaScript string-breaking characters or distinguish data from executable source
- Execution context: The injected code runs in the Flowise Node.js process and may be able to escape the in-process sandbox
Why this happens
The underlying bug is code generation from untrusted input. The application interpolated a user-controlled URL directly into a JavaScript string instead of passing it to the sandbox as a data value. Although the value underwent URL validation, that validation did not provide JavaScript-context escaping or safe separation between code and data. This behavior maps to CWE-95: Improper Neutralization of Directives in Dynamically-Evaluated Code, commonly described as code injection.
The underlying bug is code generation from untrusted input. The application interpolated a user-controlled URL directly into a JavaScript string instead of passing it to the sandbox as a data value. Although the value underwent URL validation, that validation did not provide JavaScript-context escaping or safe separation between code and data. This behavior maps to CWE-95: Improper Neutralization of Directives in Dynamically-Evaluated Code, commonly described as code injection.
Potential impact
- An attacker may execute arbitrary JavaScript in the Flowise server process.
- The attacker could potentially execute operating-system commands with the Flowise process privileges.
- Sensitive environment variables, credentials, configuration, or flow data could be exposed.
- The application could be modified, disrupted, or used for lateral movement.
- Hosted LLM workflows and connected services could be manipulated or abused.
- An attacker may execute arbitrary JavaScript in the Flowise server process.
- The attacker could potentially execute operating-system commands with the Flowise process privileges.
- Sensitive environment variables, credentials, configuration, or flow data could be exposed.
- The application could be modified, disrupted, or used for lateral movement.
- Hosted LLM workflows and connected services could be manipulated or abused.
General mitigation guidance
Mitigation should focus on preserving a strict separation between executable code and user-controlled data.
Common defensive patterns include:
- Passing URLs and other configuration values to the sandbox through structured data or controlled function arguments rather than source-code interpolation.
- Applying context-appropriate encoding whenever values must be represented in generated code.
- Using strict URL parsing and allowlisting for permitted schemes, hosts, ports, and path forms.
- Reducing or removing risky dependencies and host capabilities exposed to in-process sandboxes.
- Treating in-process sandboxing as a defense-in-depth control rather than a complete isolation boundary.
- Running the service with least privilege and limiting filesystem, network, credential, and process access.
- Separating untrusted workflow execution into a strongly isolated execution environment where practical.
Mitigation should focus on preserving a strict separation between executable code and user-controlled data.
Common defensive patterns include:
- Passing URLs and other configuration values to the sandbox through structured data or controlled function arguments rather than source-code interpolation.
- Applying context-appropriate encoding whenever values must be represented in generated code.
- Using strict URL parsing and allowlisting for permitted schemes, hosts, ports, and path forms.
- Reducing or removing risky dependencies and host capabilities exposed to in-process sandboxes.
- Treating in-process sandboxing as a defense-in-depth control rather than a complete isolation boundary.
- Running the service with least privilege and limiting filesystem, network, credential, and process access.
- Separating untrusted workflow execution into a strongly isolated execution environment where practical.
How teams detect issues like this
Detection can include:
- Static analysis rules that identify string interpolation or concatenation of user-controlled values into JavaScript passed to evaluators, virtual machines, or sandbox APIs.
- Code review checks for generated source code, dynamic evaluation, template-based scripts, and validation performed without context-specific encoding.
- Tests using boundary characters and malformed-but-parser-accepted URL values to verify that inputs remain data.
- Policy enforcement that restricts dynamic code execution and reviews dependencies exposed to workflow sandboxes.
- Runtime monitoring for unexpected child processes, outbound connections, filesystem access, or changes initiated by the Flowise service account.
- Automated security review tools can help identify unsafe code-generation patterns, but findings should be validated against the actual execution boundary.
Detection can include:
- Static analysis rules that identify string interpolation or concatenation of user-controlled values into JavaScript passed to evaluators, virtual machines, or sandbox APIs.
- Code review checks for generated source code, dynamic evaluation, template-based scripts, and validation performed without context-specific encoding.
- Tests using boundary characters and malformed-but-parser-accepted URL values to verify that inputs remain data.
- Policy enforcement that restricts dynamic code execution and reviews dependencies exposed to workflow sandboxes.
- Runtime monitoring for unexpected child processes, outbound connections, filesystem access, or changes initiated by the Flowise service account.
- Automated security review tools can help identify unsafe code-generation patterns, but findings should be validated against the actual execution boundary.
