Executive brief
Flowise, an open-source tool for building LLM applications, contains security flaws in its Model Context Protocol (MCP) feature. These flaws allow any user with an account or API access to bypass security filters and run unauthorized commands on the underlying server. An attacker could use this to steal sensitive data, disrupt operations, or gain full control over the host system.
Technical details
Flowise versions prior to 3.1.2 are vulnerable to Remote Code Execution (RCE) via three distinct bypasses in the Custom MCP Server feature. First, the 'validateCommandFlags' blocklist fails to include dangerous subcommands like 'docker build', which can be used to execute arbitrary instructions from a remote Dockerfile. Second, the blocklist for 'npx' only filters the short '-y' flag but misses the '--yes' alias, allowing the execution of malicious npm packages. Third, a regex flaw in 'validateArgsForLocalFileAccess' (using '/^\/[^/]/') can be bypassed by using double slashes (e.g., '//etc/passwd'), allowing attackers to execute local scripts. These vulnerabilities require low-privileged authenticated access or API permissions to modify chatflows. The issues are addressed in version 3.1.2.
Affected products
- FlowiseAI Flowise < 3.1.2
- FlowiseAI flowise-components < 3.1.2
Timeline
- 2026-05-14: advisory: Vendor security advisory published on GitHub
- 2026-06-23: disclosed: CVE published and NVD record created