Executive brief
Flowise is a framework for building AI agent applications. Before version 3.1.4, a validation flaw in MCP server configuration allows authenticated attackers to execute arbitrary code on the server. An attacker can set an unvalidated working directory (cwd) parameter to point to a directory containing malicious scripts, then execute them using clean filenames that bypass existing validation, resulting in complete system compromise.
Technical details
The vulnerability is an improper input validation flaw (CWE-20) in the validateMCPServerConfig() function in packages/components/nodes/tools/MCP/core.ts. The function validates the command, args, and env parameters but completely omits validation of the cwd (current working directory) parameter. An authenticated attacker can bypass security controls by specifying a clean filename in the args array (e.g., "script.js") that passes validation, while simultaneously setting the cwd parameter to an attacker-controlled directory containing malicious code. When the process spawns via StdioClientTransport, it executes from the unvalidated working directory, achieving remote code execution. The vulnerability requires authentication (low privilege) and affects Flowise versions before 3.1.4, which includes the patched version in the fix.
Affected products
- FlowiseAI Flowise before 3.1.4
- FlowiseAI flowise-components before 3.1.4
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory GHSA-x7x8-95gh-42xm published
- 2026-09-15: advisory: CVE-2026-91932 published
- 2026-09-15: patched: Fixed in Flowise 3.1.4