External risk intelligence

Flowise Sandbox Escape via Custom Function Allows OS Command Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-119978

Flowise is a web-based low-code AI orchestration platform. It is typically deployed as a web application or API service to enable developers and users to build and manage LLM workflows. While authentication is required, the product is fundamentally designed as a web-accessible service that often resides on internet-facing infrastructure or internal networks where it is commonly exposed to authenticated users.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Flowise allows authenticated users to execute operating system commands by exploiting specific modules when a certain configuration is enabled. This could potentially allow unauthorized command execution on affected systems.

Authenticated users can run system commands.
Matters if internal users can be compromised.
Confirm if this impacts our Flowise deployments.

Attack Path

How an attacker could exploit the issue

An attacker with existing access can exploit this vulnerability by submitting custom JavaScript code through a specific API endpoint. This code, when processed by the vulnerable component with a specific configuration, can lead to the execution of arbitrary operating system commands on the server, allowing the attacker to achieve significant compromise.

Authenticated access required.
Custom JavaScript submission to API.
OS command execution on server.

Live Threat

Current exploitation, exposure, and threat context

Authenticated users could execute arbitrary operating system commands on the Flowise system when specific configurations are met. This occurs when the `ALLOW_BUILTIN_DEP` setting is enabled, allowing the abuse of certain modules to write files and execute code.

System commands on the Flowise server.
Authenticated user submits crafted JavaScript.
Unauthorized OS command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Flowise platform, particularly when configured with `ALLOW_BUILTIN_DEP=true`, presents a critical sandbox escape vulnerability. This requires attention from teams managing applications and infrastructure, as authenticated users can achieve OS command execution. The immediate first step is to inventory all Flowise deployments, assess their external reachability and business criticality, identify the accountable application or platform owner, and then prioritize remediation based on the assessed risk.

Application owners should prioritize remediation.
Verify Flowise deployment reachability and criticality.
Plan maintenance for necessary updates or configuration changes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Flowise?

Flowise is a low-code AI orchestration platform that lets developers build and manage complex LLM workflows. It acts as a web-based interface or API service where users can design these data pipelines visually. Because it orchestrates AI components, it is frequently hosted on infrastructure that interacts with both private data and external web services to facilitate LLM tasks.

What is the vulnerability in CVE-2026-119978?

This is a sandbox escape, classified as CWE-749 (Insecure Exposure of Dangerous API). It means the software's safety boundaries, designed to restrict what code can do, are bypassed. In this case, the vulnerability allows an authenticated user to trick the system into running arbitrary operating system commands instead of just the intended application logic.

How can an attacker trigger this bug?

An attacker needs authenticated access to the Flowise API. They exploit the system by sending malicious JavaScript to the custom function endpoint. Importantly, this only works if the configuration ALLOW_BUILTIN_DEP is set to true. If this configuration is disabled, the specific path used to write and execute files through the underlying package modules is effectively blocked.

Who should be concerned about this vulnerability?

Organizations running Flowise should care, regardless of whether the instance is internal or external. According to Halo Surface Signal, because Flowise is an orchestration tool commonly placed on internet-facing infrastructure or accessible networks, any user with credentials—even low-privileged ones—could potentially abuse this to compromise the entire server hosting the application.

How do I respond to this threat?

First, inventory your systems to identify all active Flowise deployments. Check the configuration of each instance to see if ALLOW_BUILTIN_DEP is enabled. If it is, evaluate whether this setting is strictly necessary for your operations. Coordinate with your application owners to prioritize these instances for updates or configuration hardening to eliminate the risk of unauthorized system command execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.