PT-2026-51507 · Flowise · Flowise
CVSS v3.1
9.9
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Flowise versions prior to 3.1.2
Description
Multiple OS command injection flaws exist in the Custom MCP Server feature. An attacker with any account role or API access with view/update permissions for chatflows can execute arbitrary commands on the host machine. This is possible through three primary bypass methods:
- Incomplete blocklist in the
validateCommandFlags()function allows the use ofdocker build, which can pull remote Dockerfiles and execute instructions to gain host control. - The
validateCommandFlags()function blocks the-yflag fornpxbut fails to block the long alias--yes, allowing the automatic installation and execution of malicious npm packages. - A regex bypass in the
validateArgsForLocalFileAccess()function allows absolute paths starting with//to evade Unix absolute path restrictions, enabling thenodecommand to load and execute local files.
Recommendations
Update Flowise to version 3.1.2 or later.
As a temporary mitigation, restrict access to the Custom MCP Server feature and limit API permissions for chatflow updates.
Exploit
Fix
RCE
Incomplete List of Disallowed Inputs
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Flowise