CVE-2026-69259 in Flowise
Summary
by MITRE • 08/04/2026
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended database setting, allowing additionalConfig.database to overwrite the SQLite database path. An authenticated attacker using the published Docker image, which ran as root, could write a SQLite database to paths such as /etc/chromium/exploit.conf; by controlling the table name and namespace value, the attacker could place shell syntax into the database file and trigger execution when Puppeteer launched Chromium and sourced /etc/chromium/*.conf. This issue is fixed in version 3.1.3.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability exists within Flowise's SQLite Record Manager node, which serves as a component for managing database interactions in large language model workflows. This specific flaw affects versions prior to 3.1.3 and represents a critical path traversal and code execution vulnerability. The issue stems from improper input validation and sanitization within the SQLiteRecordManager.ts file where user-controllable parameters are directly incorporated into database configuration without adequate security checks.
The technical implementation of this vulnerability involves the spread operator being used to merge user-provided additionalConfig parameters with intended database settings, creating a scenario where attackers can manipulate the database path through the additionalConfig.database property. When Flowise runs in its published Docker container environment with root privileges, this misconfiguration allows for arbitrary file system writes to critical system locations. The attacker can specifically target paths like /etc/chromium/exploit.conf, which represents a well-known attack vector where Chromium browsers source configuration files from this directory during startup.
The operational impact of this vulnerability extends beyond simple data manipulation or unauthorized access. An authenticated attacker with workflow creation privileges can execute arbitrary code on the host system by leveraging the Puppeteer library's interaction with Chromium browser components. When Chromium launches and processes configuration files from /etc/chromium/, any malicious shell syntax embedded within the SQLite database file gets executed, providing a direct path to system compromise. This vulnerability aligns with CWE-22 (Path Traversal) and CWE-94 (Code Injection) categories, representing a dangerous combination of directory traversal combined with command injection.
The attack chain begins with an authenticated user creating a malicious workflow that incorporates the vulnerable SQLite Record Manager node, followed by crafting specific table names and namespace values to embed shell commands within the database file. When Puppeteer processes this database during Chromium startup, it inadvertently executes the embedded malicious code. This represents a sophisticated attack pattern that combines multiple exploitation techniques and aligns with ATT&CK tactics including T1059 (Command and Scripting Interpreter) and T1566 (Phishing). The vulnerability demonstrates the critical importance of input validation in web applications and highlights how seemingly innocuous configuration parameters can become attack vectors when not properly sanitized.
Organizations using Flowise should immediately implement version 3.1.3 or later to address this vulnerability, as the fix involves proper parameter sanitization and path validation that prevents arbitrary file system writes. The root cause analysis reveals that this issue stems from insufficient security controls in the component's configuration handling, emphasizing the need for comprehensive input validation across all user-controllable parameters in web applications. This vulnerability serves as a reminder of the critical nature of privilege separation and the dangers of running containerized applications with elevated privileges when they handle user-provided data.