Executive brief
Flowise is an open-source platform for building AI applications and chatflows. A vulnerability in the Custom MCP node allows authenticated users to execute arbitrary code on the Flowise server by supplying malicious npm package names. An attacker with Flowise access can run commands with the privileges of the Flowise process, potentially compromising the entire system including sensitive files, credentials, and internal networks the server can reach.
Technical details
The vulnerability exists in Flowise's Custom MCP stdio configuration, which spawns user-supplied commands to initialize Model Context Protocol servers. Although Flowise allowlists only specific commands (node, npx, python, python3, docker) and blocks certain dangerous flags (like -c, --call, --shell-auto-fallback), it fails to restrict the npm packages that npx can install and execute. An authenticated attacker can invoke npx with attacker-controlled npm package names (e.g., npx shx touch /tmp/marker) to execute arbitrary code without requiring shell metacharacters or restricted syntax. The attack is triggered via POST /api/v1/node-load-method/customMCP by supplying a malicious mcpServerConfig parameter. The vulnerability affects Flowise versions before 3.1.4; version 3.1.4 and later include fixes to remove npx from the command allowlist or enforce stricter controls.
Affected products
- Flowise Flowise before 3.1.4
- Flowise flowise-components before 3.1.4
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory (GHSA-vcwp-f9rq-3887) published
- 2026-09-15: advisory: CVE-2026-91931 and public advisories published
- 2026-08-31: patched: Version 3.1.4 available with fixes