FlowiseAI/Flowise · error · Error

Invalid path: null bytes or control characters detected

Error message

Invalid path: null bytes or control characters detected

What it means

Thrown by validateVectorStorePath (packages/components/src/validator.ts:240) when the base path contains a NUL byte (\0) or any ASCII control character in the range 0x00-0x1f. Control characters let attackers truncate or manipulate paths at the OS layer (e.g. 'safe\0.txt' interpreted as 'safe'); Flowise rejects them outright.

Source

Thrown at packages/components/src/validator.ts:240

    if (!userProvidedPath || userProvidedPath.trim() === '') {
        return path.join(getUserHome(), '.flowise', 'vectorstore')
    }

    const basePath = userProvidedPath.trim()

    // Check for explicit path traversal patterns (..)
    if (basePath.includes('..')) {
        throw new Error('Invalid path: path traversal attempt detected')
    }

    // Check for URL-encoded path traversal
    if (basePath.toLowerCase().includes('%2e') || basePath.toLowerCase().includes('%2f') || basePath.toLowerCase().includes('%5c')) {
        throw new Error('Invalid path: encoded path traversal attempt detected')
    }

    // Check for null bytes and control characters
    if (/\0/.test(basePath) || /[\x00-\x1f]/.test(basePath)) {
        throw new Error('Invalid path: null bytes or control characters detected')
    }

    // Check for Windows-specific absolute paths and UNC paths (even on Unix systems)
    // This prevents cross-platform attack vectors
    if (/^[a-zA-Z]:\\/.test(basePath)) {
        throw new Error('Invalid path: Windows absolute paths are not allowed')
    }
    if (/^\\\\[^\\]/.test(basePath)) {
        throw new Error('Invalid path: UNC paths are not allowed')
    }
    if (/^\\\\\?\\/.test(basePath)) {
        throw new Error('Invalid path: Extended-length paths are not allowed')
    }

    // Resolve to absolute path
    // If path is relative, resolve it relative to the .flowise directory (safe default)
    // If path is already absolute, keep it as-is
    let resolvedPath: string

View on GitHub (pinned to abe4a8601a)

Solutions

Strip control characters from user input before assigning to basePath (replace /[\x00-\x1f]/g).
Re-type the path by hand instead of copy-pasting from an untrusted source.
Validate paths against /^[\x20-\x7e]+$/ at the API boundary.

Example fix

// before
nodeParams.basePath = rawInput   // contains a stray \n or \0

// after
nodeParams.basePath = rawInput.replace(/[\x00-\x1f]/g, '').trim()

Defensive patterns

Strategy: validation

Validate before calling

if (/[\x00-\x1f]/.test(String(basePath ?? ''))) throw new Error('control characters in path');

Type guard

const isPrintable = (p: unknown): p is string => typeof p === 'string' && /^[\x20-\x7e]+$/.test(p);

Try / catch

try { validateVectorStorePath(basePath) } catch (e) { if (e instanceof Error && /control characters/.test(e.message)) { basePath = basePath.replace(/[\x00-\x1f]/g, '') } else throw e }

Prevention

Strip control characters from all path inputs at the API boundary.
Avoid copy-pasting paths from terminals/logs; re-type them.
Constrain path inputs to printable ASCII with a regex.

When it happens

Trigger: A node config path contains a literal \0, tab, newline, or other control char — often from binary input, copy-paste of terminal output, or a malicious payload injected via chat/API.

Common situations: Pasting paths from terminals/logs that include invisible chars; binding raw multipart/form-data without sanitization; test fixtures generated with random byte strings.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/5387c1852e779571. Report an issue: GitHub.