{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amomentjsmomentnode.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:momentjs:moment:*:*:*:*:*:node.js:*:*","cpe:2.3:a:momentjs:moment:*:*:*:*:*:nuget:*:*","cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*","cpe:2.3:a:netapp:active_iq:-:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2022-24785"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Flowise (3.1.1)","nodevm (3.9.25)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["FlowiseAI"],"content_html":"\u003cp\u003eFlowiseAI is vulnerable to a sandbox escape that allows authenticated attackers to achieve Remote Code Execution (RCE). The platform utilizes the \u003ccode\u003epatriksimek/vm2\u003c/code\u003e library (via the \u003ccode\u003enodevm\u003c/code\u003e module) to execute custom user-provided JavaScript code. Despite the library being deprecated due to inherent security flaws, several Flowise components, such as \u003ccode\u003eAgentAsTool\u003c/code\u003e, continue to invoke this sandbox with \u003ccode\u003euseSandbox: false\u003c/code\u003e or in insecure configurations.\u003c/p\u003e\n\u003cp\u003eThe vulnerability stems from an injection point within the \u003ccode\u003ebaseURL\u003c/code\u003e parameter of the \u003ccode\u003eAgentAsTool\u003c/code\u003e node. An attacker can bypass the \u003ccode\u003eisValidURL\u003c/code\u003e validation function using a hash fragment injection. This is chained with a sandbox escape that leverages a known path traversal flaw in the \u003ccode\u003emoment\u003c/code\u003e library (\u003ccode\u003eCVE-2022-24785\u003c/code\u003e). By forcing the \u003ccode\u003emoment\u003c/code\u003e library to load a malicious file, the attacker can break out of the Node.js sandbox and execute arbitrary commands on the underlying host. The issue persists in Flowise version 3.1.1 and impacts the \u003ccode\u003enodevm\u003c/code\u003e package version 3.9.25.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker authenticates to the target Flowise instance and retrieves a valid organization ID and session cookies.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the platform's document loader to upload a malicious JavaScript payload (e.g., a reverse shell) as a file (e.g., \u003ccode\u003erce.js\u003c/code\u003e) to the application server.\u003c/li\u003e\n\u003cli\u003eThe attacker initiates an \u003ccode\u003eAgentAsTool\u003c/code\u003e or similar node configuration within the Flowise workflow interface.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious \u003ccode\u003ebaseURL\u003c/code\u003e input string containing a hash fragment injection, such as \u003ccode\u003e#\u0026quot;;\\nfake = new String(\u0026quot;.../tmp/rce.js\u0026quot;); ... //\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eAgentAsTool\u003c/code\u003e component fails to sanitize the injected string due to the broken \u003ccode\u003eisValidURL\u003c/code\u003e implementation and inserts the payload into the sandboxed execution context.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003evm2\u003c/code\u003e sandbox executes the injected code, which triggers the \u003ccode\u003emoment.locale()\u003c/code\u003e bypass to traverse the filesystem and access the uploaded \u003ccode\u003erce.js\u003c/code\u003e file.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003echild_process\u003c/code\u003e module is invoked within the context of the Node.js process to execute the payload.\u003c/li\u003e\n\u003cli\u003eThe final objective is achieved via a reverse shell or arbitrary code execution on the host system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to execute arbitrary commands on the server hosting the Flowise instance. This leads to full system compromise, potential data exfiltration of internal workflows, and unauthorized access to infrastructure-level resources. Given that Flowise is often used to manage AI agents and sensitive API keys, the impact includes lateral movement within the network and potential compromise of connected third-party SaaS services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Flowise to a version where all components explicitly enforce the use of secure, containerized sandboxing (e.g., E2B) rather than the deprecated \u003ccode\u003evm2\u003c/code\u003e library.\u003c/li\u003e\n\u003cli\u003eAudit all code paths utilizing \u003ccode\u003euseSandbox: false\u003c/code\u003e in Flowise components (specifically \u003ccode\u003eAgentAsTool\u003c/code\u003e, \u003ccode\u003eChatflowTool\u003c/code\u003e, and \u003ccode\u003eExecuteFlow\u003c/code\u003e) and transition them to secure isolation mechanisms.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation for URL fields, ensuring that hash fragments and newline characters are sanitized before being processed in dynamic code generation.\u003c/li\u003e\n\u003cli\u003eRestrict the \u003ccode\u003enode-fetch\u003c/code\u003e and \u003ccode\u003emoment\u003c/code\u003e dependency access within the sandbox environment to prevent access to the local filesystem.\u003c/li\u003e\n\u003cli\u003eMonitor internal network traffic for unexpected outbound connections from the server hosting Flowise, specifically targeting ports associated with command-and-control (C2) activity (e.g., \u003ccode\u003enc\u003c/code\u003e reverse shells).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-04T17:24:16Z","date_published":"2026-08-04T17:24:16Z","id":"https://feed.craftedsignal.io/briefs/2026-08-flowise-sandbox-escape/","summary":"Authenticated attackers can exploit an insecure JavaScript sandbox configuration in FlowiseAI to execute arbitrary system commands via a chained injection and path traversal payload.","title":"Flowise Sandbox Escape to Remote Code Execution","url":"https://feed.craftedsignal.io/briefs/2026-08-flowise-sandbox-escape/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:momentjs:moment:*:*:*:*:*:node.js:*:*","version":"https://jsonfeed.org/version/1.1"}