Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-34267

CVE-2025-34267HIGH

FlowiseAI Flowise — Flowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright Packages

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   H   L   L    8.4   .0656   93.7     —

AFFECTED
  Product  Versions  Fixed
  Flowise  3.0.1 –   —

TIMELINE
  Apr 15  Reserved by VulnCheck
  Oct 14  Published (CNA: VulnCheck)
  Oct 8   EXPLOIT PUBLISHED — CVE-2025-34267 (FlowiseAI Flowise). Public exploit reference added.

CWE-77 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Analyzed

Description

Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execution environment. An authenticated attacker able to create or run a tool that leverages Puppeteer/Playwright can specify attacker-controlled browser binary paths and parameters. When the tool executes, the attacker-controlled executable/parameters are run on the host and circumvent the intended nodevm sandbox restrictions, resulting in execution of arbitrary code in the context of the host. This vulnerability was incorrectly assigned as a duplicate CVE-2025-26319 by the developers and should be considered distinct from that identifier.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
April 15, 2025	Reserved	Reserved by VulnCheck
October 14, 2025	Published	Published (CNA: VulnCheck)
October 8, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2025-34267 (FlowiseAI Flowise). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
FlowiseAI	Flowise	—	3.0.1	—

Weaknesses

CWE-77

References (4)

https://flowiseai.com/ [Product]
https://github.com/FlowiseAI/Flowise/pull/5231 [Issue Tracking]
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5w3r-f6gm-c25w [Exploit, Vendor Advisory]
https://www.vulncheck.com/advisories/flowise-auth-command-execution-and-sandbox-bypass-via-puppeteer-and-playwright-packages [Third Party Advisory]

Authoritative record: CVE-2025-34267 at cve.org

Vendors: flowiseai

Weaknesses: CWE-77

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-34267 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.