56 matches found
Flowise - Remote Code Execution
Flowise 3.0.5 contains a remote code execution vulnerability caused by unsafe evaluation of user input in the CustomMCP node's convertToValidJSONString function, letting remote attackers execute arbitrary code with full Node.js privileges, exploit requires user input to be processed by the...
CVE-2025-58434_CVE-2025-59528
CVE-2025-58434CVE-2025-59528 Script PoC CVE-2025-58434 Flowise -lp...
CVE-2026-91931
Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code ...
CVE-2026-91931 Flowise before 3.1.4 Remote Code Execution via Custom MCP npx
Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code ...
CVE-2026-91931 Flowise before 3.1.4 Remote Code Execution via Custom MCP npx
Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code ...
EUVD-2026-78789
Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code ...
CVE-2026-91931
Flowise before 3.1.4 is affected by a remote code execution vulnerability in the Custom MCP node . An authenticated attacker can supply attacker-controlled npx package names in the mcpServerConfig parameter, causing the server to execute arbitrary code via npx invocation of a malicious npm packag...
CVE-2026-91931 Flowise before 3.1.4 Remote Code Execution via Custom MCP npx
Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code ...
PT-2026-92051
Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.4 Description An issue in the Custom MCP node allows authenticated attackers to achieve remote code execution. By supplying malicious npx package names through the mcpServerConfig parameter, an attacker can force...
CVE-2026-91931: Improper Neutralization of Special Elements used in an OS Command
Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code ...
...[ More ]
Flowise versions from 2.2.7 prior to 3.1.2 are vulnerable to remote code execution through the Custom MCP Model Context Protocol node configuration. The vulnerability exists in the /api/v1/node-load-method/customMCP endpoint, which accepts arbitrary command and argument configurations for MCP...
CVE-2026-73601
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOMMCPPROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and...
CVE-2026-73601 Flowise before 3.1.3 Remote Code Execution via Custom MCP
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOMMCPPROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and...
CVE-2026-73601 Flowise before 3.1.3 Remote Code Execution via Custom MCP
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOMMCPPROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and...
CVE-2026-73601 Flowise before 3.1.3 Remote Code Execution via Custom MCP
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOMMCPPROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and...
EUVD-2026-57805
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOMMCPPROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and...
CVE-2026-73601
Flowise
CVE-2026-73601: Improper Neutralization of Directives in Dynamically Evaluated Code
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOMMCPPROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and...
PT-2026-71429
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM MCP PROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS a...
