CVE-2025-57164

Vulnerability

Overview

CVE-2025-57164 describes a remote code execution (RCE) vulnerability in Flowise, a low-code platform for building AI agents, affecting versions through v3.0.4. The flaw resides in the Supabase vector store component, specifically in the Supabase.ts file at the point where the supabaseRPCFilter user-supplied string is processed. The application directly compiles this string into a JavaScript function without any sanitization, escaping, or sandboxing, allowing arbitrary code to be executed on the server when the node is triggered [1][2].

Exploitation

Details

An attacker must first authenticate as an admin user to access the Supabase node configuration. Once authenticated, the attacker can inject a malicious payload into the "Supabase RPC Filter" field. The advisory demonstrates that payloads such as process.mainModule.require("child_process").execSync("id") are executed directly, confirming OS-level commands can be run, and environment variables can be leaked by forcing errors that display server-side secrets [2]. The attack surface is limited to authenticated admin users, but no network-level prerequisites beyond access to the Flowise web interface.

Impact

Successful exploitation grants the attacker full remote code execution on the underlying server. This can lead to complete server compromise, including the ability to launch reverse shells, exfiltrate sensitive environment variables (e.g., JWT secrets), and perform any OS-level command. The advisory categorizes the impact as a severe breach of trust boundaries between frontend input and backend execution logic [2].

Mitigation

Flowise released version 3.0.6, which includes a fix for this vulnerability. The release notes reference a commit titled "Bugfix/Securely Fetch Links" and other security improvements, though the specific patch for the Supabase RCE is not explicitly listed in the changelog [4]. Users are strongly advised to upgrade to v3.0.6 or later. No workarounds are documented; restricting admin access is a partial mitigation but does not eliminate the risk if an admin account is compromised.