CVE-2026-46442

Description

FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

Predictions

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

References

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9rvc-vf7m-pgm2
• https://github.com/FlowiseAI/Flowise
• https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2
• https://github.com/advisories/GHSA-9rvc-vf7m-pgm2