Description
FlowiseAI Flowise是一款基于LangChain框架构建的、用于可视化构建和部署大语言模型应用的开源平台。该平台支持拖拽式创建LLM应用，内置多种集成选项，广泛应用于企业AI应用开发场景。FlowiseAI Flowise /api/v1/node-custom-function接口存在远程代码执行漏洞，攻击者可通过该接口执行任意JavaScript代码和系统命令，获取服务器权限。
FlowiseAI Flowise /api/v1/node-custom-function 代码执行漏洞（CVE-2026-46442）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/advisories/GHSA-9rvc-vf7m-pgm2
https://cvefeed.io/vuln/detail/CVE-2026-46442
https://www.sentinelone.com/vulnerability-database/cve-2026-46442/
https://research.averlon.ai/vulnerability-intelligence/cve/CVE-2026-46442
https://security.snyk.io/vuln/SNYK-JS-FLOWISE-16749177
https://advisories.gitlab.com/npm/flowise/CVE-2026-46442/
https://app.opencve.io/cve/?page=2&product=flowise&vendor=flowiseai