What happened
Flowise's custom-function execution sandbox can be escaped when allowlisted langchain and mammoth modules are reachable and ALLOW_BUILTIN_DEP is enabled, letting an authenticated user run OS commands on the server.
Why it matters
Flowise is used to build and host LLM/agent applications, often by non-admin builders. A sandbox escape that yields OS command execution means a low-privilege workflow author can compromise the host that runs the agent application and any credentials it uses.
Attack vector
An authenticated user submits JavaScript through /api/v1/node-custom-function that abuses an allowlisted module (langchain/mammoth) to escape the sandbox; the submitted script writes a file into the mammoth package path, enabling OS command execution.
Affected systems
Flowise through 3.1.4, when ALLOW_BUILTIN_DEP=true and the langchain and mammoth modules are allowlisted.
Mitigation
Upgrade to the Flowise release that fixes the sandbox escape; do not enable ALLOW_BUILTIN_DEP on multi-tenant instances, and restrict which modules are allowlisted.