Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-34267 is a high-severity Command Injection (CWE-77) vulnerability in Flowiseai Flowise. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-34267 is an authenticated remote code execution vulnerability combined with a Node VM sandbox escape in Flowise, affecting versions from v3.0.1 up to but not including 3.0.8, as well as all subsequent versions where the 'ALLOW_BUILTIN_DEP' configuration option is enabled. The issue stems from insecure usage of the integrated Puppeteer and Playwright modules within the nodevm execution environment. These modules allow specification of attacker-controlled browser binary paths and parameters, which bypass the intended sandbox restrictions when a tool leveraging them is executed.
An authenticated attacker with the ability to create or run a tool that uses Puppeteer or Playwright can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation results in arbitrary code execution on the host system in the context of the Flowise process, granting high confidentiality, integrity, and availability impacts, as reflected in the CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The vulnerability is linked to CWE-77 (Command Injection).
Mitigation details are available in the official Flowise security advisory (GHSA-5w3r-f6gm-c25w) and a related pull request (#5231) on the Flowise GitHub repository, along with analysis from VulnCheck. Note that developers initially misidentified this as a duplicate of CVE-2025-26319, but it is distinct. Security practitioners should review these resources for patching instructions and disable 'ALLOW_BUILTIN_DEP' where possible. FlowiseAI is a low-code platform for building LLM applications, making this relevant to AI/ML deployments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-34455
Vulnerability Data
Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execution environment. An authenticated…
more
attacker able to create or run a tool that leverages Puppeteer/Playwright can specify attacker-controlled browser binary paths and parameters. When the tool executes, the attacker-controlled executable/parameters are run on the host and circumvent the intended nodevm sandbox restrictions, resulting in execution of arbitrary code in the context of the host. This vulnerability was incorrectly assigned as a duplicate CVE-2025-26319 by the developers and should be considered distinct from that identifier.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: flowise
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.3V1.2.5V1.2.8V1.2.9
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover command-construction flaws before deployment.
Input validation directly stops construction of commands from untrusted data containing special elements.
Secure engineering principles include proper neutralization and safe command construction practices.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and neutralization that prevent command injection.
Runtime monitoring of software and data can detect anomalous command execution resulting from injection.
Identifying recorded vulnerabilities enables remediation of command-injection flaws before exploitation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards require proper escaping and parameterization of commands, directly eliminating CWE-77.
Security testing in development catches command-injection vulnerabilities before release.
Secure development life cycle mandates input validation and command construction practices that directly prevent command injection.
Application security requirements explicitly call for controls against injection flaws including command injection.
Secure architecture principles reduce the attack surface but do not prescribe the specific neutralization techniques needed.
Environment separation limits the blast radius of an exploited command injection but does not prevent the flaw itself.