Flowise, a platform used for building AI agents and automated workflows, is currently under scrutiny due to six newly identified remote code execution vulnerabilities. These flaws could allow attackers with authentication to execute commands on servers, risking exposure of sensitive data and credentials. The vulnerabilities affect various Flowise components such as CSV processing, JavaScript functions, MCP configurations, database nodes, and record-management features. Researchers from Elttam discovered these issues while analyzing Flowise versions 3.1.1 and 3.1.2. They reported that some patches were incomplete, enabling them to bypass existing security measures.
The CSVAgent feature was particularly vulnerable, allowing attackers to exploit pandas library functions despite Flowise's attempts to block risky Python functions. Although an initial patch aimed to prevent unsafe deserialization, Elttam found that certain crafted expressions could still execute commands. As a result, developers removed the affected CSVAgent and AirtableAgent files.
Another significant flaw involved the JavaScript vm2 sandbox, which allowed certain external modules by default. This oversight enabled code execution on the host, highlighting the dangers associated with insecure integration settings. Additionally, an environment-variable injection issue was identified in Custom MCP configurations, where attackers could manipulate settings to trigger execution.
Three more vulnerabilities were found in TypeORM DataSource options, SQL Database Chain node, and SQLite Record Manager node. Each posed the risk of unsafe code execution when combined with other Flowise functions. These findings underscore the need for robust security measures for AI workflow infrastructures. Administrators should promptly update Flowise, review all nodes, and disable unnecessary components. Avoid exposing administrative interfaces and API access to the internet, and restrict permissions available to AI workflows. Running Flowise with a non-root account and monitoring for unusual activity can mitigate potential exploitation. Furthermore, Elttam recommends adopting stronger isolation models and avoiding rely on denylist validation for input security.