Flowise RCE via Malicious JavaScript Uploads

The National Vulnerability Database has disclosed CVE-2026-41269, a high-severity vulnerability (CVSS 7.1) affecting Flowise, a drag-and-drop UI for building custom large language model flows. Prior to version 3.1.0, Flowise allowed modification of Chatflow configuration file upload settings to accept application/javascript MIME types. This bypasses frontend restrictions and permits attackers to upload .js files.

This flaw enables threat actors to persistently store malicious Node.js web shells on the server. The National Vulnerability Database indicates this can lead to Remote Code Execution (RCE), giving attackers full control over the compromised system. The vulnerability is tracked as CWE-434, a common weakness involving unrestricted upload of dangerous file types.

For defenders, this is a critical supply chain risk. An RCE in a tool like Flowise, often used for AI/ML development, can lead to data exfiltration, system compromise, and further lateral movement within an environment. Patching is the only viable defense here.