The report describes a custom-function execution boundary that depends on deployment configuration. When built-in modules are allowed, an authenticated user can apparently influence files that an allowed module loads, moving from an agent tool sandbox into the host process. The public advisory has not been independently reproduced here, and a fixed vendor…
Inspect the ClaimsCase · DiggingBeagle record
Flowise advisory alleges a custom-function sandbox escape through Mammoth
An unreviewed advisory for Flowise through 3.1.4 reports a route from attacker-controlled LocalFileStore content to built-in Mammoth dependency execution when ALLOW_BUILTIN_DEP is enabled.
Scope
Unreviewed external advisory; setting-specific proof, affected versions and official remediation status need verification, with no known production exploitation.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The advisory reports a sandbox escape from Flowise custom-function execution through a dependency loading path. Treat the effect as a reported reproduction requiring the affected configuration, not proof of universal remote code execution. Impact remains unrated because the evidence does not supply a calibrated scale for this Case.
Assessed Nov 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV01-FLOWISE-MAMMOTH-ESCAPE-1 · Flowise GHSA-7pc2-8w3w-pqfg LocalFileStore and Mammoth claim
At a glance
Assess the reported tool or model action separately from the side effect actually observed.
Read the implicationsUnreviewed external advisory; setting-specific proof, affected versions and official remediation status need verification, with no known production exploitation.
Limits and uncertaintyFull account
The report describes a custom-function execution boundary that depends on deployment configuration. When built-in modules are allowed, an authenticated user can apparently influence files that an allowed module loads, moving from an agent tool sandbox into the host process. The public advisory has not been independently reproduced here, and a fixed vendor version is not established. The issue should not be merged with the distinct real-world Flowise intrusion already covered by DiggingBeagle.
Mechanism and trust boundary
- 01
Step
Claims & evidence
CLM-2026-NOV01-FLOWISE-MAMMOTH-ESCAPE-1An unreviewed advisory for Flowise through 3.1.4 reports a route from attacker-controlled LocalFileStore content to built-in Mammoth dependency execution when ALLOW_BUILTIN_DEP is enabled.supported
Basis: reported finding
- supportsFlowise GHSA-7pc2-8w3w-pqfg LocalFileStore and Mammoth claimsecondary reporting
GHSA-7pc2-8w3w-pqfg, advisory description and configuration preconditions
Implications
Assess the reported tool or model action separately from the side effect actually observed.
Controls and mitigations
- Disable unnecessary built-in module access in custom tools, isolate the host worker process and validate the vendor patch status before relying on a version-only fix.
Unknowns and contradictions
- Unreviewed external advisory; setting-specific proof, affected versions and official remediation status need verification, with no known production exploitation.
Sources and citation
Material revision history
- Nov 1, 2026 · Canonical change recorded · new in release · revision 211