UpHeron
All vulnerabilities

Servers and applications

CVE-2025-34267

Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execution environment. An authenticated attacker able to create or run a tool that leverages Puppeteer/Playwright can specify…

Severity
High 8.4
Published
14 Oct 2025
Last changed
8 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.0.8
Sources
NVD

Affected software

SoftwareAffected versions
FlowiseServers and applications · cpe:a:flowiseai:flowise
  • From 3.0.1 before 3.0.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-34267
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-34267