RCE in Flowiseai Flowise

CVE-2026-69254

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode() accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/c…

Vulnerability class: RCE (Remote Code Execution)