External risk intelligence

Flowise Code Injection via Malicious Base URL

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-69253

Flowise is a web-based application designed for building and managing LLM flows. Such tools are commonly deployed as web interfaces or API services accessible to users within an organization, creating an externally reachable web application surface.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in Flowise, a tool used for building custom large language model (LLM) flows. The issue could allow an authenticated user to inject and execute malicious JavaScript code on the Flowise server, potentially leading to arbitrary code execution. The main concern is confirming if Flowise is used and if this specific vulnerability is relevant to your environment.

Code injection in LLM flow building tool.
Impacts server security if authenticated users exploit it.
Assess Flowise usage and potential exposure.

Attack Path

How an attacker could exploit the issue

An authenticated user could craft a malicious `baseURL` to inject JavaScript into the Flowise application. This could allow an attacker to escape the sandbox environment and execute arbitrary code on the server.

Authenticated session required.
Crafting `baseURL` to inject JavaScript.
Arbitrary code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user could inject malicious JavaScript into Flowise, allowing them to execute arbitrary code on the server. This could impact system data and potentially sensitive information when the user has an authenticated session.

Server-side code execution.
Malicious input bypasses validation.
Arbitrary code runs on server.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Flowise impacts custom-tool components that execute code within the `vm2` sandbox, allowing authenticated users to inject and run arbitrary JavaScript on the Flowise server. Owners of Flowise deployments, likely platform or application teams, must first identify all instances of Flowise, assess their exposure and criticality, and then coordinate remediation.

Platform/Application teams should own the issue.
Verify Flowise instances and accessibility first.
Plan risk-based remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Flowise?

Flowise is a visual, drag-and-drop platform that enables developers to design and deploy complex workflows for large language models (LLMs). It simplifies the integration of various AI components, acting as a central interface for managing how data moves through custom LLM pipelines. Because it often serves as a hub for AI logic, it typically runs on a server that manages these flows and executes supporting scripts.

How does CVE-2026-69253 lead to code execution?

This vulnerability involves code injection (CWE-95). When the software built JavaScript source code, it improperly embedded a user-supplied 'baseURL' directly into a command string. By crafting a specific input, a user could manipulate the script to break out of the intended logic. Because the underlying sandbox environment shared the same process as the main application, this breakout allowed the injected code to escape security constraints and execute arbitrary commands on the host server.

Can this be triggered without an account?

No, exploitation requires an active, authenticated session. The vulnerability cannot be triggered by unauthenticated visitors or external users who lack access to the Flowise interface. It specifically relies on an authorized user who has the permissions to modify the tool configurations where the vulnerable 'baseURL' is processed.

Why should I be concerned if my Flowise instance is internal?

Halo Surface Signal notes that Flowise is commonly deployed as a web interface or API service, which often results in an externally reachable application surface. Even if you consider your deployment internal, any authenticated user—such as an employee or someone who has compromised a user account—can exploit this. Accessibility increases the risk, as it broadens the potential pool of users who could interact with the vulnerable component.

How do I secure my environment against this vulnerability?

The primary step is to upgrade your Flowise deployment to version 3.1.3 or later. This release fundamentally changes how the software handles URLs by passing them as data rather than inserting them directly into code strings, effectively closing the injection path. Before applying the update, perform an inventory of all Flowise instances in your network to ensure full coverage during the remediation process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.