Unsafe serialization of stdio commands in the MCP adapter allows an authenticated user in Flowise to create a new MCP stdio server with an arbitrary command. The attacker bypasses existing sanitization checks, such as validateCommandInjection, validateArgsForLocalFileAccess, and the list of safe commands, by combining a safe command like npx with execution arguments. As a result, the attacker can execute arbitrary shell commands on the host operating system, giving full control over the server where Flowise is running. The vulnerability is classified as CWE‑78, reflecting an operating system command injection flaw. The impact is remote code execution that can compromise system confidentiality, integrity, and availability.

Flowise AI’s Flowise platform and its flowise-components library are affected. The issue exists in all releases prior to version 3.1.0 of Flowise. Users running any older firmware or build that includes the legacy MCP adapter can be exploited.

The CVSS score of 10 marks this as a critical flaw. The EPSS score is not available, and it is not listed in the CISA KEV catalog, but the lack of an available exploit metric does not diminish the inherent severity. Exploitation requires a valid authenticated session within the Flowise UI; the attacker must use the http://localhost:3000/canvas interface to add a new MCP. Because the exploit consumes user privileges and creates a new MCP that runs arbitrary code, the attack vector is effectively local to the application’s authentication boundary but can lead to full system compromise. No public proof‑of‑concept is currently documented, yet the fixed nature of the vulnerability and the simplicity of the payload suggest that a motivated attacker could leverage this flaw to achieve remote code execution once authenticated.