What is the CVSS score of CVE-2026-40933?

CVE-2026-40933 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Flowise are affected by CVE-2026-40933?

FlowiseAI Flowise npm packages (versions 3.0.13 and below) contain a critical authenticated remote code execution vulnerability in the MCP stdio server configuration.. A patch is available.

How to fix or mitigate CVE-2026-40933?

Within 24 hours: Inventory all systems running npm packages flowise or flowise-components, verify installed versions, and restrict Flowise access to minimum required users; review authentication logs for suspicious activity. Within 7 days: Upgrade flowise and flowise-components packages to versions above 3.0.13 per vendor advisory across all development, staging, and production environments. Within 30 days: Validate all instances post-patch, audit MCP stdio server configurations, and implement runtime monitoring for custom MCP spawned processes.

Flowise CVE-2026-40933

CRITICAL

OS Command Injection (CWE-78)

2026-04-16 https://github.com/FlowiseAI/Flowise

GHSA-c9gw-hvqq-f33r

RCE Command Injection

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Any authenticated user (PR:L) can remotely (AV:N) and reliably (AC:L, UI:N) break out of the app to run OS commands, a scope change (S:C) with total C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:18 vuln.today

Analysis Generated

Jul 24, 2026 - 07:18 vuln.today

CVSS changed

Apr 21, 2026 - 22:22 NVD

10.0 (CRITICAL) 9.9 (CRITICAL)

Patch released

Apr 17, 2026 - 02:30 nvd

Patch available

CVE Published

Apr 16, 2026 - 21:18 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

Summary

Due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution.

Details

The vulnerability lies in a bug in the input sanitization from the “Custom MCP” configuration in http://localhost:3000/canvas - where any user can add a new MCP, when doing so - adding a new MCP using stdio, the user can add any command, even though your code have input sanitization checks such as validateCommandInjection and validateArgsForLocalFileAccess, and a list of predefined specific safe commands - these commands, for example "npx" can be combined with code execution arguments ("-c touch /tmp/pwn") that enable direct code execution on the underlying OS.

https://github.com/FlowiseAI/Flowise/blob/d848baeb6bd9737a1e7fc912349c45fbdcc7bb38/packages/components/nodes/tools/MCP/core.ts#L223

https://github.com/FlowiseAI/Flowise/blob/d848baeb6bd9737a1e7fc912349c45fbdcc7bb38/packages/components/nodes/tools/MCP/core.ts#L177

https://github.com/FlowiseAI/Flowise/blob/d848baeb6bd9737a1e7fc912349c45fbdcc7bb38/packages/components/nodes/tools/MCP/core.ts#L269

PoC

Create a new Custom MCP and add an "npx -c" command.

{
    "command": "npx",
    "args": [
        "-c",
        "touch /tmp/pwn"
    ]
}

Impact

This is an authenticated arbitrary command execution due to unsanitized input, even though the input is sanitized, more protections should be added in order to close ways for attackers to execute arbitrary commands.

AnalysisAI

Authenticated remote command execution in FlowiseAI Flowise (npm packages flowise and flowise-components) versions <= 3.0.13 allows any logged-in user to run arbitrary OS commands by configuring a Custom MCP stdio server. The MCP adapter's allow-list of 'safe' binaries (e.g. npx) can be abused with code-execution arguments that bypass the validateCommandInjection and validateArgsForLocalFileAccess sanitizers, yielding total host compromise. Publicly available exploit code exists (SSVC exploitation: poc), though EPSS is low at 0.07%; it is not listed in CISA KEV.

Technical ContextAI

Flowise is a low-code visual builder for LLM/agent workflows. The affected component is its Model Context Protocol (MCP) adapter (packages/components/nodes/tools/MCP/core.ts), which lets users attach 'Custom MCP' servers. A stdio-type MCP server is launched by spawning a local process from a user-supplied command and args array. The root cause is CWE-78 (OS Command Injection): the adapter attempts to constrain risk via input sanitization (validateCommandInjection, validateArgsForLocalFileAccess) plus a predefined list of permitted binaries, but this allow-list approach is unsound because permitted interpreters such as npx accept arguments that themselves execute arbitrary code. The sanitizer blocks shell metacharacter injection but does not model the semantics of the allowed binaries, so 'unsafe serialization of stdio commands' passes attacker-controlled arguments straight to process execution.

RemediationAI

Vendor-released patch: upgrade Flowise and flowise-components to 3.1.0 or later, which is the fixed release per GHSA-c9gw-hvqq-f33r (https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-c9gw-hvqq-f33r). Until upgrading, restrict who can create or edit Custom MCP nodes - limit canvas/tool-configuration access to fully trusted operators only and disable self-service account creation, since exploitation requires an authenticated user. Place Flowise behind strong authentication and network controls (VPN or IP allow-listing) rather than exposing it to the internet, and enforce unique non-default credentials, because the allow-list of 'safe' commands cannot be relied on to prevent execution. Where feasible, run the Flowise process as a low-privilege, sandboxed/containerized user with no outbound egress and read-only mounts to blunt the impact of command execution; the trade-off is that legitimate MCP stdio servers needing broader host or network access may break and must be explicitly re-permitted.