Flowise versions prior to 3.1.2 contain operating‑system command injection vulnerabilities in the Custom MCP Server feature. By submitting a malicious MCP server configuration, an attacker can bypass the validateCommandFlags blocklist and the validateArgsForLocalFileAccess checks, allowing execution of arbitrary commands on the host system. This flaw endangers confidentiality, integrity, and availability of the Flowise host.

All installations of Flowise main product running a version earlier than 3.1.2 are affected. The vulnerability is present regardless of the user role; any Flowise account or API access that can modify chatflows is sufficient to abuse the flaw.

The CVSS score of 8.7 indicates high severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is via a legitimate Flowise account or API key with chatflow update permissions. An attacker could remotely trigger the vulnerable MCP server configuration and execute arbitrary commands on the host, but requires authentication to the Flowise instance.