p PatchFirst

CVE-2026-69259

CVE-2026-69259 · Flowise RCE via SQLite Record Manager Node

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended database setting, allowing additionalConfig.database to overwrite the SQLite database path. An authenticated attacker using the published Docker image, which ran as root, could write a SQLite database to paths such as /etc/chromium/exploit.conf; by controlling the table name and namespace value, the attacker could place shell syntax into the database file and trigger execution when Puppeteer launched Chromium and sourced /etc/chromium/*.conf. This issue is fixed in version 3.1.3.

CVSS 9.4 · Critical · EPSS 0.8% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • flowise

    Versions
    • < 3.1.3: Affected

    No fix published

  • flowise npm

    Affected ranges
    • SEMVER: < 3.1.3

    Update to 3.1.3

  • flowise-components npm

    Affected ranges
    • SEMVER: < 3.1.3

    Update to 3.1.3

Original sources

Check your server →