Flowise - RCE (CVE-2026-46442)
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is not configured — the common deployment case — Flowise executes this code inside a NodeVM sandbox. This sandbox can be escaped, allowing an attacker to reach the host process object and execute system commands via child_process. The result is authenticated remote code execution on the Flowise server host. This issue has been patched in version 3.1.2.
psychologyCrowdSec Analysis
CVE-2026-46442 is a critical remote code execution vulnerability in Flowise versions prior to 3.1.2, caused by missing route-level authorization on the Custom JS Function endpoint and an escapable NodeVM sandbox. An authenticated user or API key can submit malicious JavaScript, escape the sandbox, and execute system commands on the Flowise server, potentially resulting in full compromise of the host and connected systems.
CrowdSec has been tracking this vulnerability and its exploits since 3rd of August 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-46442 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target the /api/v1/node-custom-function endpoint with an authenticated JSON POST request containing malicious JavaScript in the functionBody field. The payload invokes child_process to execute system commands, often validated through an external DNS callback.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-06-08 |
| Rule Released | 2026-08-03 |
| CrowdSec First Seen | 2026-09-04 |