Flowise CVE-2026-91931

Requires an authenticated Flowise account (PR:L) with the ability to create or edit a Custom MCP node and control the mcpServerConfig parameter; the deployment must have the MCP/npx execution path reachable (npx/npm present on the host, which is standard for Flowise's Node.js runtime). The exploit works against Flowise versions before 3.1.4. Limiting factors: authentication is mandatory (no pre-auth exploitation), so exposure is driven by how many users can reach the node editor and by whether the instance is internet-facing or has weak/shared credentials; there is no user-interaction requirement beyond the attacker's own actions.

This is a genuine, high-priority issue but with a meaningful gating condition. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N with full VC:H/VI:H/VA:H) describes authenticated (PR:L) remote code execution - the PR:L is corroborated by the description's explicit 'authenticated attackers' wording. Exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no POC signal in the provided data, so this should not be treated as actively exploited despite the 9.0 score. EPSS is not provided, so probabilistic exploitation likelihood cannot be quantified. The reporting by VulnCheck plus a published GHSA advisory and available vendor patch indicate a well-substantiated, real vulnerability rather than a speculative or over-scored one. The one contestable metric is AC:H: once an attacker holds a valid authenticated session, supplying an attacker-controlled npx package name in mcpServerConfig is mechanically simple, so the attack complexity is arguably low rather than high - this would push the true severity even higher, not lower. The subsequent-system impacts (SC:H/SI:H/SA:H) in the vendor 4.0 vector appear overstated: code executes within the Flowise server process context with no clear scope change to a separate security authority, so a same-system (SC:N/SI:N/SA:N) reading is more defensible. Net: a real priority to patch for any internet-exposed or multi-user Flowise instance, tempered by the authentication requirement.

An attacker with valid low-privilege credentials to a Flowise instance (or one obtained via weak/default auth or credential theft) creates or edits a Custom MCP node and sets mcpServerConfig to invoke npx against an attacker-published npm package. When Flowise launches the MCP server, npx downloads and executes that package's code on the server, yielding arbitrary command execution in the Flowise process context. No public POC is identified in the provided data, but the technique (malicious npm package + npx) is well-understood and trivially reproducible once authenticated.