GHSA-w6v6-49gh-mc9w

## Summary The Faiss and SimpleStore (LlamaIndex) vector store implementations accept a `basePath` parameter from user-controlled input and pass it directly to filesystem write operations without any sanitization. An authenticated attacker can exploit this to write vector store data to arbitrary locations on the server filesystem. ## Vulnerability Details | Field | Value | |-------|-------| | Affected File | `packages/components/nodes/vectorstores/Faiss/Faiss.ts` (lines 79, 91) | | Affected File | `packages/components/nodes/vectorstores/SimpleStore/SimpleStore.ts` (lines 83-104) | ## Prerequisites 1. **Authentication**: Valid API token with `documentStores:upsert-config` permission 2. **Document Store**: An existing Document Store with at least one processed chunk 3. **Embedding Credentials**: Valid embedding provider credentials (e.g., OpenAI API key) ## Root Cause ### Faiss (`Faiss.ts`) ```typescript async upsert(nodeData: INodeData): Promise<Partial<IndexingResult>> { const basePath = nodeData.inputs?.basePath as string // User-controlled // ... const vectorStore = await FaissStore.fromDocuments(finalDocs, embeddings) await vectorStore.save(basePath) // Direct filesystem write, no validation } ``` ### SimpleStore (`SimpleStore.ts`) ```typescript async upsert(nodeData: INodeData): Promise<Partial<IndexingResult>> { const basePath = nodeData.inputs?.basePath as string // User-controlled let filePath = '' if (!basePath) filePath = path.join(getUserHome(), '.flowise', 'llamaindex') else filePath = basePath // Used directly without sanitization const storageContext = await storageContextFromDefaults({ persistDir: filePath }) // Writes to arbitrary path } ``` ## Impact An authenticated attacker can: 1. **Write files to arbitrary locations** on the server filesystem 2. **Overwrite existing files** if the process has write permissions 3. **Potential for code execution** by writing to web-accessible directori