Description

Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code on the Flowise server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-09-15T16:17:43.883Z",
  "pubdate": "2026-09-15T16:17:43.883Z",
  "executiveSummary": "Flowise versions prior to 3.1.4 are susceptible to a Remote Code Execution (RCE) vulnerability located within the Custom MCP (Model Context Protocol) node configuration.\nThe vulnerability arises from improper input validation when handling the mcpServerConfig parameter, which allows an authenticated user to specify arbitrary npx package names.\nBy manipulating this configuration, an attacker can force the host server to execute malicious code via the npx command utility.\nSuccessful exploitation grants an attacker the ability to execute arbitrary commands with the privileges of the underlying Flowise process, potentially leading to full server compromise, data exfiltration, or lateral movement within the network.\nThis vulnerability requires the attacker to be authenticated to the Flowise instance, which significantly limits the initial attack surface but poses a critical risk in multi-user or exposed environments where account security might be compromised.",
  "technicalDetails": "The vulnerability resides in the Custom MCP node component of Flowise, specifically in the logic responsible for initializing and managing MCP servers. The system provides a configuration interface, the mcpServerConfig, designed to allow users to integrate external tools or servers using the Model Context Protocol.\nThe root cause is an insecure implementation of system command execution, where user-supplied inputs for npx package names are passed directly to an underlying shell or process execution function without adequate sanitization or an allowlist mechanism. When the Custom MCP node is invoked, the application triggers the execution of 'npx' to resolve and run the specified package.\nAn authenticated attacker can supply a malicious package name—such as an attacker-controlled npm package hosted on a public registry or a local path—via the mcpServerConfig parameter. When the application attempts to initialize the MCP server, it executes 'npx <attacker_supplied_package>'. Since npx is designed to fetch and execute binaries, this process results in the immediate execution of arbitrary code.\nThe attack flow follows these steps: 1) The attacker authenticates to the Flowise administrative interface. 2) The attacker navigates to a Custom MCP node configuration. 3) The attacker modifies the mcpServerConfig field to reference a malicious npm package. 4) The application processes the configuration and executes the npx command. 5) The arbitrary code contained within the malicious package executes on the host server environment.\nThe post-exploitation impact is severe, as the code executes within the security context of the Flowise server process. This could allow for the exfiltration of sensitive flow configurations, environment variables (often containing API keys or database credentials), and potentially provide the attacker with a persistent shell or the ability to pivot into the internal network. The vulnerability remains present in all versions of Flowise strictly before 3.1.4."
}