CVE-2026-91936 in Flowise
Summary
by MITRE • 09/15/2026
Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tag_version and node_version to execute arbitrary commands and steal AWS credentials and Docker Hub tokens.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The security flaw identified in Flowise versions prior to 3.1.4 represents a critical server-side request forgery vector embedded within the software supply chain, specifically targeting GitHub Actions workflows that utilize docker build processes. This vulnerability stems from an insecure coding practice where user-supplied inputs, such as tag_version and node_version triggered via workflow_dispatch events, are directly interpolated into shell execution blocks without adequate sanitization or validation. By failing to escape special characters, the application allows attackers with repository write access to inject arbitrary shell metacharacters, effectively bypassing intended isolation boundaries within the continuous integration pipeline. This class of defect is formally categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as operating system command injection, which remains one of the most dangerous vulnerabilities due to its potential for complete system compromise.
The operational impact of this vulnerability extends far beyond simple code execution within a containerized environment. Because these workflows typically handle sensitive infrastructure credentials, successful exploitation enables attackers to exfiltrate high-value assets such as AWS access keys and Docker Hub authentication tokens. The ability to execute arbitrary commands allows an adversary to manipulate the build process, inject malicious payloads into distributed images, or pivot laterally across connected cloud resources. This aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, where adversaries use shell scripts to automate actions on compromised systems, as well as T1620 Reflective Code Injection if the attacker modifies in-memory structures during the build process. The compromise of CI/CD pipelines is particularly severe because it undermines trust in all downstream artifacts built by that pipeline, potentially infecting production environments with backdoored software.
Mitigation strategies must prioritize immediate remediation through version upgrades to Flowise 3.1.4 or later, where input validation and output encoding mechanisms have been implemented to prevent shell metacharacter injection. In the interim, organizations should enforce strict least-privilege principles on repository write access, ensuring that only trusted contributors can trigger workflow_dispatch events. Additionally, implementing branch protection rules that require manual approval for changes to workflow configuration files can provide a critical layer of defense against unauthorized modifications. Security teams should also audit existing workflows for similar patterns of direct variable interpolation in shell commands and replace them with safer alternatives such as using quoted variables or dedicated scripting languages that handle escaping automatically. Regular scanning of container images and dependency trees is essential to detect any residual malicious artifacts resulting from prior exploitation attempts.