Flowise `vm2` Sandbox Escape to Remote Code Execution (CVE-2026-69253)

FlowiseAI Flowise, all versions before 3.1.3

Flowise lets users run custom JavaScript through nodes such as Custom Function, Agent Flow, and Custom Tool, inside a sandbox backed by the `patriksimek/vm2` package. Because `vm2` executes untrusted code in the same Node.js process as the application, an attacker who appends code to a URL that breaks out of the string context can reach the host process by pivoting through risky dependencies already loaded, including a path traversal in the `moment` library. The `vm2` maintainers deprecated the project some time ago with a warning that it has critical security issues and should not be used in production. Rated CVSS 8.5. Fixed in Flowise 3.1.3. This is at least the fourth remote code execution issue disclosed in Flowise in 2026, after CVE-2025-59528, CVE-2026-41264, and CVE-2026-40933

An in-process JavaScript sandbox used as a security boundary for attacker-influenced code, built on a library its own authors abandoned as unsafe for that purpose