Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Flowise allows an unauthenticated attacker to execute arbitrary code on the server. It occurs when an LLM-generated Python script is evaluated without proper sandboxing, meaning malicious code injected through a chatflow can run with server privileges. This is a serious risk because it can compromise the entire Flowise instance.
- Unauthenticated attackers can gain control.
- Sensitive data or server functions may be compromised.
- The issue is present in versions before 3.1.0.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this flaw by crafting a malicious prompt that tricks the LLM into generating and executing harmful Python code. This code would run on the Flowise server, allowing the attacker to control the compromised system.
- Requires unauthenticated prompt access.
- Targets LLM-generated Python script evaluation.
- Prompt injection convinces LLM to execute code.
Live Threat
Current exploitation, exposure, and threat context
Attackers may find this vulnerability appealing due to its ability to allow unauthenticated code execution on a server through prompt injection, bypassing normal security controls. While the direct impact is server-side code execution, the ultimate goal would be to leverage that access for broader network compromise or data exfiltration. The method requires crafting specific prompts to an LLM, which can be challenging but is a known technique for exploiting AI systems.
- Exploitation may require sophisticated prompt engineering.
- Public exploit code is not immediately apparent.
- The vulnerability impacts a tool for building AI applications.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize isolating or taking offline services using Flowise versions prior to 3.1.0, especially if they process untrusted input via the CSV Agent node. Review logs for signs of suspicious Python script execution or unauthorized command activity. The critical nature and remote unauthenticated exploitability of this vulnerability demand immediate containment.
- Upgrade Flowise to version 3.1.0 or later.
- Block network access to vulnerable Flowise instances.
- Monitor for unusual process execution on affected servers.
