Flowise RCE via SQLite Record Manager Node
=============================================================================
Security Advisory
elttam
Topic: Flowise RCE via SQLite Record Manager Node
Module: FlowiseAI/Flowise
Disclosed: 24-Apr-2026
Credits: Alex Brown
Affects: FlowiseAI/Flowise 3.1.2
# I. Background
Flowise AI is an open-source, low-code platform for building AI applications—such as chatbots, workflows, and autonomous agents—through an intuitive drag-and-drop interface, minimising the need for extensive coding.
Flowise allows users to connect to a local SQLite database for record management of Upsert Vector Store operations.
# II. Problem Description
The database path for the "SQLite Record Manager" node could be overridden using the additionalConfig input, as demonstrated in the following code snippet.
[https://github.com/FlowiseAI/Flowise/blob/[email protected]/packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts](https://github.com/FlowiseAI/Flowise/blob/flowise-components%403.1.2/packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts)
```ts
class SQLiteRecordManager_RecordManager implements INode {
...
async init(nodeData: INodeData, _: string, options: ICommonObject): Promise<any> {
const _tableName = nodeData.inputs?.tableName as string
const tableName = _tableName ? _tableName : 'upsertion_records'
const additionalConfig = nodeData.inputs?.additionalConfig as string <1>
const _namespace = nodeData.inputs?.namespace as string
const namespace = _namespace ? _namespace : options.chatflowid
const cleanup = nodeData.inputs?.cleanup as string
const _sourceIdKey = nodeData.inputs?.sourceIdKey as string
const sourceIdKey = _sourceIdKey ? _sourceIdKey : 'source'
let additionalConfiguration = {}
if (additionalConfig) {
try {
additionalConfiguration = typeof additionalConfig === 'object' ? additionalConfig : JSON.parse(additionalConfig)
} catch (exception) {
throw new Error('Invalid JSON in the Additional Configuration: ' + exception)
}
}
const database = path.join(process.env.DATABASE_PATH ?? path.join(getUserHome(), '.flowise'), 'database.sqlite') <2>
const sqliteOptions = {
database,
...additionalConfiguration, <3>
type: 'sqlite'
}
const args = {
sqliteOptions,
tableName: tableName
}
const recordManager = new SQLiteRecordManager(namespace, args)
;(recordManager as any).cleanup = cleanup
;(recordManager as any).sourceIdKey = sourceIdKey
return recordManager
}
}
```
<1> The additionalConfig input was user controllable.
<2> The intended SQLite database path.
<3> Keyword argument expansion of the additionalConfiguration variable after the database variable, which allows overwriting the preceding database setting.
An attacker could abuse this weakness to write an SQLite database to an arbitrary filepath, which includes system directories since the [flowiseai/flowise:3.1.2](https://hub.docker.com/layers/flowiseai/flowise/3.1.2/images/sha256-ddba104d8e50fbc1e72c6fe021d012be83e66d78d26816e1a6a3fddab4212eff) Docker image runs as root.
However, unlike the [Flowise RCE via SQL Database Chain Node vulnerability](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-pwfj-wh95-7mwp), the executed SQL query was not user controllable and the tableName input was validated to match the /^[a-zA-Z0-9_]+$/ regex pattern, as shown in the following code snippet.
[https://github.com/FlowiseAI/Flowise/blob/[email protected]/packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts](https://github.com/FlowiseAI/Flowise/blob/flowise-components%403.1.2/packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts)
```ts
class SQLiteRecordManager implements RecordManagerInterface {
...
sanitizeTableName(tableName: string): string {
// Trim and normalize case, turn whitespace into underscores
tableName = tableName.trim().toLowerCase().replace(/\s+/g, '_')
// Validate using a regex (alphanumeric and underscores only)
if (!/^[a-zA-Z0-9_]+$/.test(tableName)) { <1>
throw new Error('Invalid table name')
}
return tableName
}
...
async createSchema(): Promise<void> {
const dataSource = await this.getDataSource()
try {
const queryRunner = dataSource.createQueryRunner()
const tableName = this.sanitizeTableName(this.tableName) <1>
await queryRunner.manager.query(` <2>
CREATE
