PatchTheCVECVE-2026-119978: Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS co
CVE-2026-119978 is a high-severity flaw (CVSS 8.5) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth package via LocalFileStore and requires it, escaping vm2 as the Flowise process user.
Why this priority
- High severity
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 8.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | n/a |
| CISA exploited list | No |
| Weakness | CWE-749 |
| Published | 2026-10-30 |
| Last modified | 2026-10-30 |
Last updated 2026-10-30 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Research and news
- Vulners Bulletins: CVE-2026-119978 Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore 2026-10-30
- Vulners Bulletins: CVE-2026-119978 Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore 2026-10-30
- VulDB Recent Entries: CVE-2026-119978 | FlowiseAI Flowise up to 3.1.4 LocalFileStore utils.ts os command injection 2026-10-30
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-119978?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-119978 being exploited?
CVE-2026-119978 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-119978 affect?
CVE-2026-119978 affects affected software. Severity is high (CVSS 8.5). Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submit JavaScript to /api/v
How urgent is CVE-2026-119978?
Priority 30/100. High severity
Software pages
OpenAI and LLM tools vulnerabilities