Flowise Custom-Function Endpoint Authorization Bypass Leading to Host RCE

Missing route-level auth on POST /api/v1/node-custom-function plus a NodeVM sandbox escape yields authenticated code execution as the Flowise process user

FlowiseAI Flowise versions 3.1.1 and earlier expose POST /api/v1/node-custom-function without the authorization middleware applied elsewhere in the app, letting any authenticated user or API key submit raw JavaScript to the Custom Function node. When the optional E2B_APIKEY isolated-sandbox integration isn't configured — the default in most self-hosted setups — Flowise runs that code in a Node.js vm/NodeVM sandbox that can be escaped through its error-object constructor chain, handing the attacker child_process access on the host. The result is authenticated remote code execution as the Flowise service account, with full read/write over stored credentials, chatflows, and any connected systems. Fixed in 3.1.2 — upgrade immediately.