Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supabase RPC Filter" field.

Affected: npm: flowise

## Summary

An authenticated admin user of **FlowiseAI** can exploit the **Supabase RPC Filter** component to execute **arbitrary server-side code** without restriction. By injecting a malicious payload into the filter expression field, the attacker can directly trigger JavaScript's `execSync()` to launch reverse shells, access environment secrets, or perform any OS-level command execution.

This results in **full server compromise** and severe breach of trust boundaries between frontend input and backend execution logic.

## Details

FlowiseAI includes a component called `Supabase.ts`, located at: `packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237`

<img width="622" height="177" alt="image(3)" src="https://github.com/user-attachments/assets/f30ccd12-4709-44ac-a6ef-8f57a1cb5c3b" />

This creates a function from user-provided string `supabaseRPCFilter` with no filtering, escaping, or sandboxing in place. Any injected JavaScript in this string is compiled and executed **immediately** when the node is triggered.

### Exploit

We configured our environment to use Supabase entities as follows:

<img width="573" height="765" alt="image(4)" src="https://github.com/user-attachments/assets/b8c721db-7b6b-4fb4-99c1-a4b0c3f98caf" />

To confirm the vulnerability, a filter expression was crafted to forcibly raise an error and expose sensitive environment variables:

<img width="1920" height="915" alt="image(5)" src="https://github.com/user-attachments/assets/19e377dd-fd78-…

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Flowise ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.