{"metadata": {"vulnerability": "CVE-2026-119978", "count": 18, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-30T00:00:00Z", "date_only": false, "value": "2026-10-30T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119978", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T17:24:18.282Z", "date_only": false, "value": "2026-10-30T17:24:18.282Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-119978", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-30T17:28:31.216Z", "date_only": false, "value": "2026-10-30T17:28:31.216Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119978", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T17:44:46.883Z", "date_only": false, "value": "2026-10-30T17:44:46.883959Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117531101521480593", "record": "CVE-2026-119978", "field": "creation_timestamp", "uuid": "d35ab75e-b9e7-486a-a1f1-4068e39fb91e", "content": "CVE-2026-119978 Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth package via LocalFileStore and requires it, escaping vm2 as the Flowise process user.\nhttps://www.cve.org/CVERecord?id=CVE-2026-119978https://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c95/packages/components/src/utils.ts#L55-L114https://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c95/packages/components/src/utils.ts#L1733https://github.com/advisories/GHSA-9gvv-qjj3-2p6ghttps://github.com/FlowiseAI/Flowisehttps://www.vulncheck.com/advisories/flowise-through-3.1.4-custom-function-sandbox-escape-rce-via-localfilestore#FlowiseAI #Flowise#CVE_2026_119978#bot", "url": "https://infosec.exchange/users/cve/statuses/117531101521480593"}, {"timestamp": "2026-10-30T18:17:27Z", "date_only": false, "value": "2026-10-30T18:17:27Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7PC2-8W3W-PQFG", "record": "GHSA-7PC2-8W3W-PQFG", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-30T18:17:27.577Z", "date_only": false, "value": "2026-10-30T18:17:27.577", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119978", "record": "FKIE_CVE-2026-119978", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T18:32:44Z", "date_only": false, "value": "2026-10-30T18:32:44Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7PC2-8W3W-PQFG", "record": "GHSA-7PC2-8W3W-PQFG", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T18:36:06.474Z", "date_only": false, "value": "2026-10-30T18:36:06.474137Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3jslu2waz424j", "record": "CVE-2026-119978", "field": "creation_timestamp", "uuid": "18269a4b-07ee-4073-bb65-1af05769f314", "content": "CVE-2026-119978 - Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore\nCVE ID : CVE-2026-119978\n \n Published : Oct. 30, 2026, 5:28 p.m. | 32\u00a0minutes ago\n \n Description : Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authentica...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3jslu2waz424j"}, {"timestamp": "2026-10-30T21:00:07.741Z", "date_only": false, "value": "2026-10-30T21:00:07.741885Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mz4oefeq7x2w", "record": "CVE-2026-119978", "field": "creation_timestamp", "uuid": "faddb977-cf3a-4a7a-b200-b7138d3c7a47", "content": "CVE-2026-119978 - flowise\nThe Flowise application version up to 3.1.4 can be tricked by a logged\u2011in user into running operating\u2011system commands. By sending specially crafted JavaScript to a custom function\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#flowise #flowiseai #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mz4oefeq7x2w"}, {"timestamp": "2026-10-31T00:31:37.835Z", "date_only": false, "value": "2026-10-31T00:31:37.835631Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/4ztgchech2dje", "record": "CVE-2026-119978", "field": "creation_timestamp", "uuid": "a0078b9b-b0c9-4942-95ac-514752f6c6ef", "content": "\ud83d\udea8 CVE-2026-119978\nAffected product: see description\nCVSS 9.0 / KEV: No\nTL;DR: Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted\u2026\nhttps://cvesentinel.com/report/CVE-2026-119978\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/4ztgchech2dje"}, {"timestamp": "2026-11-02T01:05:40.041Z", "date_only": false, "value": "2026-11-02T01:05:40.041679Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzc4zbwgkk2z", "record": "CVE-2026-119978", "field": "creation_timestamp", "uuid": "4047ba48-a94e-4544-b595-d9474ce37b4c", "content": "\ud83d\udfe0 CVE-2026-119978 - High (8.5)\n\nFlowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-119978/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzc4zbwgkk2z"}, {"timestamp": "2026-11-02T20:53:41.605Z", "date_only": false, "value": "2026-11-02T20:53:41.605Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119978", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-02T21:31:44Z", "date_only": false, "value": "2026-11-02T21:31:44Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7PC2-8W3W-PQFG", "record": "GHSA-7PC2-8W3W-PQFG", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-06T16:32:49.809Z", "date_only": false, "value": "2026-11-06T16:32:49.809557Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-119978", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-06T16:32:49.809Z", "date_only": false, "value": "2026-11-06T16:32:49.809557Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119978", "record": "FKIE_CVE-2026-119978", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-06T16:33:02.320Z", "date_only": false, "value": "2026-11-06T16:33:02.320Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-119978", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-06T16:33:02.320Z", "date_only": false, "value": "2026-11-06T16:33:02.320Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-119978", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-06T17:17:19.960Z", "date_only": false, "value": "2026-11-06T17:17:19.960", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119978", "record": "FKIE_CVE-2026-119978", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-10T10:11:55.897Z", "anchors": {"origin": {"timestamp": "2026-10-30T00:00:00Z", "date_only": false, "value": "2026-10-30T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119978", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-30T00:00:00Z", "date_only": false, "value": "2026-10-30T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119978", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 987115.89746, "hours": 274.19886040555554, "days": 11.424952516898149, "min_seconds": 900715.89746, "max_seconds": 987115.89746, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-30T00:00:00Z", "date_only": false, "value": "2026-10-30T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119978", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-10T10:11:55.897Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}