Cn-Panda

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 3.1.2 **Description** Multiple OS command injection flaws exist in the Custom MCP Server feature. An attacker with any account role or API access with view/update permissions for chatflows can execute arbitrary commands on the host machine. This is possible through three primary bypass methods: 1. Incomplete blocklist in the `validateCommandFlags()` function allows the use of `docker build`, which can pull remote Dockerfiles and execute instructions to gain host control. 2. The `validateCommandFlags()` function blocks the `-y` flag for `npx` but fails to block the long alias `--yes`, allowing the automatic installation and execution of malicious npm packages. 3. A regex bypass in the `validateArgsForLocalFileAccess()` function allows absolute paths starting with `//` to evade Unix absolute path restrictions, enabling the `node` command to load and execute local files. **Recommendations** Update Flowise to version 3.1.2 or later. As a temporary mitigation, restrict access to the Custom MCP Server feature and limit API permissions for chatflow updates.

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 3.1.0 **Description** A server-side request forgery (SSRF) issue exists in the Execute Flow node. This occurs due to missing secureFetch verification in `httpSecurity.ts`, allowing attackers to bypass security validation by providing intranet addresses through the base URL field. This can be used to initiate HTTP requests to internal network addresses, access cloud metadata, and enumerate internal services. **Recommendations** Update to version 3.1.0 or later. As a temporary workaround, restrict the use of the base URL field in the Execute Flow node to prevent the use of internal network addresses.