CVE-2026-91931 in Flowise
Summary
by MITRE • 09/15/2026
Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code on the Flowise server.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The security flaw identified in versions of Flowise prior to 3.1.4 represents a critical remote code execution vulnerability located within the Custom MCP node functionality. This issue stems from an improper restriction or validation mechanism applied to the mcpServerConfig parameter, which is designed to accept configuration details for Model Context Protocol servers. Specifically, the application fails to adequately sanitize inputs that are intended to specify package names for npx execution. By allowing authenticated users to supply arbitrary npm package identifiers in this field, the system inadvertently enables the invocation of the npx command-line tool with attacker-controlled arguments. This architectural oversight transforms a configuration input into an executable vector, bypassing standard security controls and granting unauthorized actors direct access to the underlying operating system shell on the host server running Flowise.
From a technical perspective, the vulnerability exploits the trust relationship between the application framework and its execution environment. When the Custom MCP node processes the mcpServerConfig parameter, it passes the provided package name directly to npx without sufficient validation of whether the input constitutes a legitimate library or a malicious script payload. Since npx is capable of downloading and executing packages from the npm registry on demand, an attacker can supply a specially crafted package name that points to a repository containing executable code with side effects. Upon execution, this code runs with the privileges of the user account under which the Flowise service operates. This mechanism effectively circumvents sandboxing measures if they are not strictly enforced at the container or process level, allowing for full system compromise rather than just application-level disruption.
The operational impact of this vulnerability is severe, as it leads to complete remote code execution on the affected server. An authenticated attacker can leverage this flaw to install backdoors, exfiltrate sensitive data stored within the Flowise environment, pivot to other systems on the internal network, or disrupt service availability by consuming system resources through malicious processes. The presence of authentication requirements does not mitigate the risk significantly in environments where credentials may be compromised via phishing, credential stuffing, or weak password policies. Consequently, any user account with access to configure Custom MCP nodes becomes a potential entry point for critical infrastructure compromise, affecting data integrity and confidentiality across all connected AI models and tools managed by Flowise.
This vulnerability aligns closely with CWE-94, which describes Improper Control of Generation of Code (Code Injection), specifically where untrusted input is used in the construction of executable code or commands. Furthermore, it maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, as the attacker utilizes npx, a command-line interpreter for Node.js packages, to execute arbitrary instructions on the target system. The exploitation path also reflects CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection), given that the input directly influences shell-level operations through the package manager interface.
To mitigate this risk immediately, organizations should upgrade Flowise to version 3.1.4 or later, where the developers have implemented stricter validation and sanitization routines for inputs passed to the npx execution context. Until an update can be applied, administrators should restrict network access to the Custom MCP node configuration endpoints to only trusted internal IP addresses if possible. Additionally, running Flowise with minimal system privileges ensures that even if code execution occurs, the blast radius is contained within a restricted user environment rather than granting root or administrative control. Implementing strict input validation policies and monitoring for unusual npx activity in server logs can also aid in early detection of exploitation attempts while permanent patches are deployed across the infrastructure.