Flowise Sandbox Escape to Remote Code Execution

FlowiseAI is vulnerable to a sandbox escape that allows authenticated attackers to achieve Remote Code Execution (RCE). The platform utilizes the patriksimek/vm2 library (via the nodevm module) to execute custom user-provided JavaScript code. Despite the library being deprecated due to inherent security flaws, several Flowise components, such as AgentAsTool, continue to invoke this sandbox with useSandbox: false or in insecure configurations.

The vulnerability stems from an injection point within the baseURL parameter of the AgentAsTool node. An attacker can bypass the isValidURL validation function using a hash fragment injection. This is chained with a sandbox escape that leverages a known path traversal flaw in the moment library (CVE-2022-24785). By forcing the moment library to load a malicious file, the attacker can break out of the Node.js sandbox and execute arbitrary commands on the underlying host. The issue persists in Flowise version 3.1.1 and impacts the nodevm package version 3.9.25.

Attack Chain

1. The attacker authenticates to the target Flowise instance and retrieves a valid organization ID and session cookies.
2. The attacker uses the platform's document loader to upload a malicious JavaScript payload (e.g., a reverse shell) as a file (e.g., rce.js) to the application server.
3. The attacker initiates an AgentAsTool or similar node configuration within the Flowise workflow interface.
4. The attacker crafts a malicious baseURL input string containing a hash fragment injection, such as #";\nfake = new String(".../tmp/rce.js"); ... //.
5. The AgentAsTool component fails to sanitize the injected string due to the broken isValidURL implementation and inserts the payload into the sandboxed execution context.
6. The vm2 sandbox executes the injected code, which triggers the moment.locale() bypass to traverse the filesystem and access the uploaded rce.js file.
7. The child_process module is invoked within the context of the Node.js process to execute the payload.
8. The final objective is achieved via a reverse shell or arbitrary code execution on the host system.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary commands on the server hosting the Flowise instance. This leads to full system compromise, potential data exfiltration of internal workflows, and unauthorized access to infrastructure-level resources. Given that Flowise is often used to manage AI agents and sensitive API keys, the impact includes lateral movement within the network and potential compromise of connected third-party SaaS services.

Recommendation

• Upgrade Flowise to a version where all components explicitly enforce the use of secure, containerized sandboxing (e.g., E2B) rather than the deprecated vm2 library.
• Audit all code paths utilizing useSandbox: false in Flowise components (specifically AgentAsTool, ChatflowTool, and ExecuteFlow) and transition them to secure isolation mechanisms.
• Implement strict input validation for URL fields, ensuring that hash fragments and newline characters are sanitized before being processed in dynamic code generation.
• Restrict the node-fetch and moment dependency access within the sandbox environment to prevent access to the local filesystem.
• Monitor internal network traffic for unexpected outbound connections from the server hosting Flowise, specifically targeting ports associated with command-and-control (C2) activity (e.g., nc reverse shells).