Exploit Code Goes Public for Critical Flowise One-Click RCE Flaw
A published proof-of-concept puts every self-hosted Flowise deployment at risk of full remote code execution — no authentication required from the attacker, just a malicious chatflow import.
Flowise is an open-source, low-code platform for building LLM-powered applications. Self-hosted deployments are common in enterprise and developer environments. That footprint now has a problem.
Publicly available exploit code targets a critical remote code execution vulnerability in Flowise. The flaw is a one-click bug: an attacker crafts a malicious chatflow file and tricks a user into importing it. One import, arbitrary code runs on the server. Game over for the host.
The attack chain is short. No vulnerability in a browser, no memory corruption, no long exploit chain to maintain. The entire premise is social engineering plus a malformed configuration file. That simplicity is exactly what makes it dangerous at scale — operators running Flowise in internal tooling stacks may not treat a chatflow file with the same suspicion they'd apply to an executable.
Proof-of-concept code in the wild compresses the window between disclosure and active exploitation to days, sometimes hours. Threat actors running initial-access operations watch these drops closely. A self-hosted AI workflow tool sitting on a corporate network with outbound connectivity is a useful beachhead — it likely has API keys, model credentials, and data pipeline access baked in.
Flowise users should update to the patched version immediately. Operators who cannot patch right now should restrict who can import chatflows and audit recent import logs for anything unexpected. Air-gapping the import functionality from untrusted users is the minimum acceptable control until a patch is applied.
No ransomware group has publicly claimed exploitation yet. That window is narrow.
