Executive brief
Flowise is a low-code platform for building AI applications using a drag-and-drop interface. Versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP (Model Context Protocol) node when stdio mode is enabled. Authenticated users can execute arbitrary system commands by manipulating environment variables or command arguments, potentially compromising the entire application and underlying server.
Technical details
The vulnerability exists in the Custom MCP node's configuration validation logic when CUSTOM_MCP_PROTOCOL is set to stdio. The code implements a deny-list approach for environment variables that is incomplete, missing dangerous variables like PYTHONWARNINGS and BROWSER. Attackers with authentication can inject these environment variables when configuring a Custom MCP server to achieve RCE when the node's available actions are refreshed. The allowlist for executable commands (node, npx, python, python3, docker) is also insufficient, as these interpreters can be exploited through environment variable injection or relative path traversal to execute arbitrary code. The vulnerability requires authentication and is reachable over the network, with no user interaction beyond configuring the Custom MCP node.
Affected products
- FlowiseAI Flowise < 3.1.3
- FlowiseAI flowise-components < 3.1.3
Timeline
- 2026-04-15: disclosed: Vulnerability disclosed by Alex Brown (elttam)
- 2026-07-29: advisory: GitHub security advisory GHSA-g98q-rm45-q9h8 published
- 2026-08-13: patched: Fixed in Flowise 3.1.3 and flowise-components 3.1.3