Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution. The vulnerability lies in a bug in the input sanitization from the “Custom MCP” configuration in http://localhost:3000/canvas - where any user can add a new MCP, when doing so - adding a new MCP using stdio, the user can add any command, even though your code have input sanitization checks such as validateCommandInjection and validateArgsForLocalFileAccess, and a list of predefined specific safe commands - these commands, for example "npx" can be combined with code execution arguments ("-c touch /tmp/pwn") that enable direct code execution on the underlying OS. This vulnerability is fixed in 3.1.0.
Published: 2026-04-21
Score: 10 Critical
EPSS: 1.3% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Flowise’s MCP adapter performs unsafe serialization of stdio commands, allowing an authenticated user to create a new MCP with arbitrary shell commands; this flaw results in remote code execution on the host operating system, and is classified as CWE-78, an operating system command injection vulnerability.

Affected Systems

The vulnerability affects Flowise AI’s Flowise platform and its flowise-components library in all releases prior to version 3.1.0; the affected component is configured through the http://localhost:3000/canvas Custom MCP dialog.

Risk and Exploitability

The CVSS score of 10 and an EPSS of 1% highlight a critical flaw that is not listed in the CISA KEV catalog; exploitation requires a valid authenticated session in Flowise, after which an attacker can add a stdio-based MCP and supply a command such as npx -c … to execute arbitrary code on the underlying operating system, offering full control over the host.

Generated by OpenCVE AI on September 24, 2026 at 21:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Flowise to version 3.1.0 or later, which removes the unsafe serialization logic.
  • If a patch cannot be applied immediately, restrict or disable the Custom MCP configuration that permits adding new MCPs, or remove the stdio adapter plugin from the configuration.
  • Monitor Flowise logs for unexpected MCP creation events or command execution, and enforce strict access controls and least privilege on the Flowise instance until the patch is applied.

Generated by OpenCVE AI on September 24, 2026 at 21:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-c9gw-hvqq-f33r Flowise: Authenticated RCE Via MCP Adapters
History

Thu, 23 Apr 2026 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*

Wed, 22 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Flowiseai
Flowiseai flowise
Flowiseai flowise-components
Vendors & Products Flowiseai
Flowiseai flowise
Flowiseai flowise-components

Wed, 22 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
Description Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution. The vulnerability lies in a bug in the input sanitization from the “Custom MCP” configuration in http://localhost:3000/canvas - where any user can add a new MCP, when doing so - adding a new MCP using stdio, the user can add any command, even though your code have input sanitization checks such as validateCommandInjection and validateArgsForLocalFileAccess, and a list of predefined specific safe commands - these commands, for example "npx" can be combined with code execution arguments ("-c touch /tmp/pwn") that enable direct code execution on the underlying OS. This vulnerability is fixed in 3.1.0.
Title Flowise: Authenticated RCE Via MCP Adapters
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Flowiseai Flowise Flowise-components
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-04-22T13:20:11.714Z

Reserved: 2026-04-15T20:40:15.518Z

Link: CVE-2026-40933

cve-icon Vulnrichment

Updated: 2026-04-22T13:19:57.512Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-21T22:16:19.383

Modified: 2026-06-17T10:45:54.440

Link: CVE-2026-40933

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T21:15:15Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')