EUVD-2026-25285
GHSA-cvrr-qhgw-2mm6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Flowise API
-
DeliverySend single crafted override request
-
ExploitBypass FILE-STORAGE:: includes() check
-
ExecutionOverride mcpServerConfig with NODE_OPTIONS loader
-
PersistNode loads malicious JavaScript
-
ImpactExecute commands as root in container
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires that the Flowise instance be network-reachable and that the API override (overrideConfig) code path be reachable so an attacker-supplied mcpServerConfig is processed by replaceInputsWithConfig; the attacker embeds the FILE-STORAGE:: token anywhere in the value (e.g. inside a /* comment */) to trigger the .includes() bypass and injects NODE_OPTIONS via the Custom MCP node, whose blocklist omits NODE_OPTIONS. No authentication, user interaction, or knowledge of the instance is needed (PR:N/UI:N), and default configurations of versions <= 3.0.13 are affected. The main limiting factors are reachability of the override/MCP flow and that the fix in 3.1.0 closes it; impact is amplified in containerized deployments because injected code runs as root. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) is internally consistent with the description: network-reachable, low-complexity, unauthenticated, no user interaction, total impact - corroborated by the SSVC Technical Impact of 'total'. SSVC also records Exploitation: poc (public exploit code exists) and Automatable: no, meaning exploitation is not trivially mass-scalable even though it needs only one request. The EPSS score is low (0.17%, 38th percentile), which appears to conflict with the critical CVSS but reflects EPSS's short-window observed-activity model soon after disclosure rather than the intrinsic ease of exploitation; a low EPSS here should not be read as low technical risk. This is not KEV-listed, so there is no confirmed active exploitation. Overall this is a genuine high-priority issue for any internet-exposed Flowise instance: unauthenticated root RCE with public POC outweighs the currently low EPSS. |
| Exploit ScenarioDerived | An attacker locates an internet-exposed Flowise instance and sends a single crafted prediction/API request whose overrideConfig embeds the FILE-STORAGE:: keyword inside a comment to bypass validation, overriding mcpServerConfig to set NODE_OPTIONS=--experimental-loader pointing at attacker-controlled JavaScript. When the Custom MCP node spawns, Node loads the loader and runs arbitrary commands as root inside the container, requiring no authentication or prior knowledge of the instance. Public POC/exploit detail is available via the GitHub security advisory (SSVC 'poc'). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Remote code execution in Flowise before 3.1.0 lets an unauthenticated attacker run arbitrary OS commands as root inside the container with a single HTTP request. The flaw chains a parameter-override validation bypass (the FILE-STORAGE:: keyword check) with NODE_OPTIONS environment-variable injection through the Custom MCP node. Publicly available exploit code exists per the SSVC 'poc' rating, though EPSS is only 0.17%; no active exploitation has been confirmed.
RemediationAI
Vendor-released patch: upgrade Flowise (and flowise-components) to 3.1.0 or later, which fixes both the FILE-STORAGE:: bypass and the NODE_OPTIONS injection; see GHSA-cvrr-qhgw-2mm6 (https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cvrr-qhgw-2mm6). If you cannot upgrade immediately, remove the instance from public exposure and place it behind authenticated access or a VPN, since the attack needs only a single unauthenticated HTTP request; disable the API override feature so external overrideConfig values are not applied (this breaks any workflow relying on runtime parameter overrides); and avoid or restrict the Custom MCP node, which is the sink for the NODE_OPTIONS injection (this disables MCP tool functionality). As container hardening that limits blast radius rather than closing the flaw, run the container as a non-root user with a least-privilege/read-only filesystem. These are compensating controls only - patching to 3.1.0 is the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Flowise is a Node.js/TypeScript low-code platform for building LLM orchestration flows. The root cause is CWE-20 (Improper Input Validation) in the replaceInputsWithConfig function in packages/server/src/utils/index.ts: a guard meant to permit file-type overrides tests overrideConfig[config].includes('FILE-STORAGE::') using .includes() rather than .startsWith(), so the keyword can appear anywhere in a string (even inside a /* comment */) to satisfy the check. The guard performs no parameter-type validation, so it applies to any parameter name including mcpServerConfig, and when it passes it skips isParameterEnabled() entirely - allowing override of parameters administrators never exposed. The injected mcpServerConfig reaches the Custom MCP node (packages/components/nodes/tools/MCP/core.ts), whose dangerous-env blocklist covers only PATH, LD_LIBRARY_PATH and DYLD_LIBRARY_PATH but not NODE_OPTIONS, so an attacker sets NODE_OPTIONS=--experimental-loader to execute attacker-controlled JavaScript before the main process starts. Affected CPE is cpe:2.3:a:flowiseai:flowise (npm packages flowise and flowise-components <= 3.0.13).
Know when Flowise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Single unauthenticated HTTP request (AV:N/AC:L/PR:N/UI:N) yields root command execution in-container with total confidentiality, integrity and availability impact; scope unchanged as no other system is compromised.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
5DescriptionGitHub Advisory
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override bypass using the FILE-STORAGE:: keyword combined with a NODE_OPTIONS environment variable injection. This allows for the execution of arbitrary system commands with root privileges within the containerized Flowise instance, requiring only a single HTTP request and no authentication or knowledge of the instance. This vulnerability is fixed in 3.1.0.
Executive ViewAI
Flowise AI orchestration platform versions before 3.1.0 are vulnerable to unauthenticated attacks that grant attackers complete control of containerized infrastructure. Any organization deploying affected versions faces immediate risk of system takeover, data exfiltration, and lateral movement to connected networks without authentication, requiring urgent remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Arbitrary file read and write in Flowise versions prior to 3.0.8 allows an authenticated attacker with access to the flo
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Authenticated users can upload arbitrary files to Flowise 3.0.7 due to missing validation, enabling persistent storage o
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Authenticated remote code execution in FlowiseAI Flowise (v3.0.1 up to but not including 3.0.8, and later versions when
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise pr
Exploit-DB