{
  "id": 4454489,
  "title": "The Spread Operator Is an Allowlist With Nothing In It: CVE-2026-69258 in Flowise",
  "url": "https://urgent.news/2026/08/30/the-spread-operator-is-an-allowlist-with-nothing-in-it-cve-2026-69258",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-30T14:44:38.000Z",
  "source": {
    "name": "HackerNoon",
    "slug": "hackernoon",
    "url": "https://hackernoon.com/the-spread-operator-is-an-allowlist-with-nothing-in-it-cve-2026-69258-in-flowise?source=rss"
  },
  "original_language": "en",
  "account": "Three characters of JavaScript code can grant unauthorized write access to any object property, including new ones added later. This vulnerability, tracked as CVE-2026-69258, enables an unauthenticated caller to manipulate objects within the execution context of a public chatflow. The affected application, Flowise, a popular visual builder for Large Language Model (LLM) applications, spread the attacker-controlled object into the execution context of two separate sites. In both instances, the vulnerability existed in files that already contained the necessary security gate, positioned only twenty lines away from the protected area. The cause of this issue lies in JavaScript's object spread syntax, a primitive operation that allows copying data properties from one object to another. The ECMAScript specification defines how object spread works, with two key aspects relevant to security: later keys overwrite earlier ones, and the position of the spread operation determines its behavior. When the spread is placed at the end of an object literal, it functions as a defaults mechanism. However, when positioned at the beginning, it becomes a write primitive, effectively granting unrestricted access to the target object's properties. This operation uses CreateDataPropertyOrThrow, which does not invoke setters on the target object or walk the prototype chain. Consequently, it does not trigger the prototype pollution primitive, which places the vulnerability in a different category. The TypeScript backend used by Flowise does not provide additional protection against this type of attack. While the language offers an excess property check for object literals assigned to typed targets, it does not apply this check when the spread source is typed as a permissive record. As a result, any keys present in the source object, even those chosen by an attacker, will be copied to the target object without validation. In the case of Flowise, the vulnerable line of code is annotated with a TypeScript type, but this annotation does not safeguard against runtime shape divergence. The application exposes chatflows over HTTP, allowing unauthenticated access to the /api/v1/prediction/:id endpoint, which accepts an overrideConfig parameter for configuration overrides. This parameter, when combined with the object spread vulnerability, creates a critical mass assignment surface. Flowise had previously addressed a related issue (GHSA-5cph-wvm9-45gj) that allowed the overrideConfig parameter to reach node input parameters through a separate function. However, the current vulnerability persists due to the lack of comprehensive gating for the overrideConfig parameter in multiple locations within the codebase.",
  "summary": "CVE-2026-69258: two ungated spread operators let an unauthenticated caller write into the flow execution context of any public Flowise chatflow.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}