CVE-2026-119978 — Vulnerability intelligence

FlowiseAI — Flowise

Published: 2026-10-30T17:28:31.216Z

CVSS

9

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth package via LocalFileStore and requires it, escaping vm2 as the Flowise process user.

Sources

• CVE-2026-119978
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• CVE-2026-119978