Executive brief
Flowise, a tool for building LLM-based applications, contains a vulnerability that allows an attacker to execute arbitrary code on the server. This occurs because a previous security fix could be bypassed by using specific environment variables to force the installation and execution of malicious software. In default installations without authentication, this allows a remote attacker to take full control of the Flowise process and access sensitive data or internal systems.
Technical details
This vulnerability is a patch bypass for CVE-2025-8943. While Flowise implemented a blocklist for dangerous command-line flags (like npx --yes), the environment variable validation in 'packages/components/nodes/tools/MCP/core.ts' only checks for a hardcoded list of four variables (PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, NODE_OPTIONS). An attacker can use 'npm_config_yes=true' to bypass the flag filter, causing npx to auto-install and execute arbitrary packages. Other variables like PYTHONPATH and NODE_PATH are also missing from the blocklist, allowing for module hijacking. This leads to unauthenticated RCE in default deployments where the Flowise API is exposed without credentials. The issue is addressed in version 3.1.3 by improving environment variable handling.
Affected products
- FlowiseAI flowise <= 3.1.2
- FlowiseAI flowise-components <= 3.1.2
Timeline
- 2026-07-29: disclosed: Initial disclosure to GitHub Advisory Database
- 2026-08-04: advisory: GitHub Advisory published
- 2026-08-04: patched: Fix released in version 3.1.3