Parameter override bypass remote command execution in Flowise (CVE-2026-41268)

Flowise contains a critical unauthenticated remote command execution vulnerability exploitable via a parameter override bypass using the FILE-STORAGE:: keyword combined with NODE_OPTIONS environment variable injection. A flaw in the replaceInputsWithConfig function uses .includes() rather than .startsWith() for the FILE-STORAGE:: check, allowing attackers to embed the keyword in a comment to bypass all validation and override the mcpServerConfig parameter. Exploitation requires only a single HTTP request and no authentication, enabling execution of arbitrary system commands with root privileges within the containerized instance. Affected versions: - npm flowise <= 3.0.13 - npm flowise-components <= 3.0.13 We recommend updating to: 3.1.0. CVSS 9.8 · our assessment: act_now Reference: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cvrr-qhgw-2mm6 Details: https://vuln.today/cve/CVE-2026-41268