GHSA-wg86-r78f-74mp: Flowise Sandbox Escape to RCE

============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: Luke Jahnke and Alex Brown Affects: FlowiseAI/Flowise 3.1.1, FlowiseAI/nodevm 3.9.25 I. Background Flowise AI is an open-source, low-code platform for building AI applications—such as chatbots, workflows, and autonomous agents—through an intuitive drag-and-drop interface, minimising the need for extensive coding. The platform also enables execution of custom JavaScript within a sandboxed environment via the Custom Function Agent Flow node or Custom Tool. By default, this sandbox is powered by patriksimek/vm2, a fork of the patriksimek/vm2 package. II. Problem Description NOTE: This vulnerability still impacts commit dddfb3c90eec900d747790a439bd362a764039cd (the latest commit on the main branch at the time of writing). The original report was incorrectly closed, due to a misunderstanding that the report was about the use of an outdated and vulnerable version of the patriksimek/vm2 sandbox. The sandbox escape that this report documents is an issue with Flowise, and patching the vm2 sandbox would not resolve it. The patriksimek/vm2 sandbox executes JavaScript within the same Node.js process, which introduces significant security limitations and makes safely isolating untrusted code inherently difficult. Due to these concerns, the maintainers had deprecated the project and previously issued the following warning: *https://github.com/n8n-io/vm2* The library contains critical security issues and should not be used in production. Maintenance has been discontinued. Consider migrating to isolated-vm. To demonstrate the risks associated with the use of the vm2 sandbox, a sandbox escape specific to Flowise was investigated. The code snippet below shows the allowed modules that could be used within custom JavaScript code on Flowise. https://github.com