Is CVE-2026-91931 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91931 being exploited in the wild.

How severe is CVE-2026-91931?

High severity, with a CVSS score of 8.5, published 15 September 2026.

Which products and versions are affected?

Flowise Flowise before 3.1.4; Flowise flowise-components before 3.1.4.

Is there a fix for CVE-2026-91931?

A patch was published on 2026-08-31: Version 3.1.4 available with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91931 attacked?

It is attacked over the network.

Am I affected by CVE-2026-91931?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91931: Flowise Custom MCP remote code execution via npx

CVE-2026-91931 · Severity: high · CVSS 8.5 · Published 2026-09-15

Flowise is an open-source platform for building AI applications and chatflows. A vulnerability in the Custom MCP node allows authenticated users to execute arbitrary code on the Flowise server by supplying malicious npm package names. An attacker with Flowise access can run commands with the privileges of the Flowise process, potentially compromising the entire system including sensitive files, credentials, and internal networks the server can reach.

Quick answers

Is CVE-2026-91931 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91931 being exploited in the wild.
How severe is CVE-2026-91931?: High severity, with a CVSS score of 8.5, published 15 September 2026.
Which products and versions are affected?: Flowise Flowise before 3.1.4; Flowise flowise-components before 3.1.4.
Is there a fix for CVE-2026-91931?: A patch was published on 2026-08-31: Version 3.1.4 available with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91931 attacked?: It is attacked over the network.
Am I affected by CVE-2026-91931?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Flowise's Custom MCP stdio configuration, which spawns user-supplied commands to initialize Model Context Protocol servers. Although Flowise allowlists only specific commands (node, npx, python, python3, docker) and blocks certain dangerous flags (like -c, --call, --shell-auto-fallback), it fails to restrict the npm packages that npx can install and execute. An authenticated attacker can invoke npx with attacker-controlled npm package names (e.g., npx shx touch /tmp/marker) to execute arbitrary code without requiring shell metacharacters or restricted syntax. The attack is triggered via POST /api/v1/node-load-method/customMCP by supplying a malicious mcpServerConfig parameter. The vulnerability affects Flowise versions before 3.1.4; version 3.1.4 and later include fixes to remove npx from the command allowlist or enforce stricter controls.

Affected products

Flowise Flowise before 3.1.4
Flowise flowise-components before 3.1.4

Timeline

2026-08-31: disclosed: GitHub Security Advisory (GHSA-vcwp-f9rq-3887) published
2026-09-15: advisory: CVE-2026-91931 and public advisories published
2026-08-31: patched: Version 3.1.4 available with fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.