23 matches found
CVE-2025-58434_CVE-2025-59528
CVE-2025-58434CVE-2025-59528 PoC Script CVE-2025-58434 Flowise -lp...
CVE-2026-91931
Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code ...
CVE-2026-91931 Flowise before 3.1.4 Remote Code Execution via Custom MCP npx
Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code ...
CVE-2026-91931
Flowise before 3.1.4 is affected by a remote code execution vulnerability in the Custom MCP node . An authenticated attacker can supply attacker-controlled npx package names in the mcpServerConfig parameter, causing the server to execute arbitrary code via npx invocation of a malicious npm packag...
CVE-2026-91931 Flowise before 3.1.4 Remote Code Execution via Custom MCP npx
Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code ...
CVE-2026-91931
Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code ...
PT-2026-92051
Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.4 Description An issue in the Custom MCP node allows authenticated attackers to achieve remote code execution. By supplying malicious npx package names through the mcpServerConfig parameter, an attacker can force...
CVE-2026-91931: Improper Neutralization of Special Elements used in an OS Command
Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code ...
...[ More ]
Flowise versions from 2.2.7 prior to 3.1.2 are vulnerable to remote code execution through the Custom MCP Model Context Protocol node configuration. The vulnerability exists in the /api/v1/node-load-method/customMCP endpoint, which accepts arbitrary command and argument configurations for MCP...
CVE-2026-73601
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOMMCPPROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and...
CVE-2026-73601
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOMMCPPROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and...
CVE-2026-73601 Flowise before 3.1.3 Remote Code Execution via Custom MCP
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOMMCPPROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and...
CVE-2026-73601
Flowise
EUVD-2026-57805
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOMMCPPROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and...
CVE-2026-73601: Improper Neutralization of Directives in Dynamically Evaluated Code
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOMMCPPROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and...
PT-2026-71429
Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description Authenticated users can achieve remote code execution in the Custom MCP node when the CUSTOM MCP PROTOCOL is set to stdio. This occurs through the manipulation of command arguments and environment...
📄 Flowise 3.1.3 Arbitrary Code Execution
Flowise version 3.1.3 suffers from an arbitrary code execution vulnerability. On Windows, the Custom MCP stdio environment variable validation uses case-sensitive comparison. Supplying "nodeoptions" bypasses the NODEOPTIONS denylist and allows arbitrary code execution via --require. Exploit Title...
CVE-2026-58057
Flowise before 3.1.3 is affected: a case-sensitive denylist for Custom MCP stdio environment variables allows bypass on Windows (case-insensitive env names). An authenticated user who can configure a Custom MCP node can inject NODE_OPTIONS --require to execute arbitrary code in the Flowise server...
Exploit for Code Injection in Flowiseai Flowise
CVE-2025-59528.yaml Flowise is a drag & drop user interface to...
CVE-2025-59528
Flowise 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig string is parsed and passed to the Function() constructor via convertToValidJSONString without validation, allowing an attacker to execute arbitrary JavaScript with Node.js privileges (e.g., ac...