EUVD-2026-52795
GHSA-xc48-889x-5qmw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible and low complexity; PR:L reflects API access needed even on no-auth defaults; S:C because arbitrary package execution escapes Flowise's application scope to the host OS.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install and execute the named package when a Custom MCP server launched. This issue is fixed in version 3.1.3.
AnalysisAI
Flowise's patch for CVE-2025-8943 is fully bypassed in versions up to and including 3.1.2, allowing unauthenticated remote code execution on default deployments via the npm_config_yes environment variable. The prior mitigation blocked the -y and --yes flags on npx and denied four specific environment variable names by exact string match, but npm natively reads its configuration from any npm_config_* prefixed variable, making npm_config_yes=true semantically equivalent to --yes. Any attacker who can submit a Custom MCP stdio server configuration - which requires no authentication on default Flowise deployments - can force npx to auto-install and execute an arbitrary package as the Flowise server process. No public exploit code has been identified at time of analysis, though the bypass technique is fully documented in the public GHSA advisory GHSA-xc48-889x-5qmw, making independent weaponization trivial.
Technical ContextAI
Flowise is a Node.js application (cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*) that provides a drag-and-drop interface for composing LLM workflows, including integration with Model Context Protocol (MCP) servers over both SSE and stdio transports. The vulnerable code resides in packages/components/nodes/tools/MCP/core.ts, where the validateEnvironmentVariables function implements a hardcoded four-item denylist - ['PATH', 'LD_LIBRARY_PATH', 'DYLD_LIBRARY_PATH', 'NODE_OPTIONS'] - checked by exact string match. The root cause class is CWE-184 (Incomplete List of Disallowed Inputs): npm's documented behavior allows any environment variable of the form npm_config_<option> to override the corresponding CLI flag, so npm_config_yes=true is treated identically to --yes by the npm runtime. This means npx will auto-install the named package without confirmation, bypassing the flag-level check in validateCommandFlags entirely. The stdio transport path in CustomMCP.ts previously defaulted to stdio whenever a command was provided, giving attackers a reachable execution primitive. The fix in 3.1.3 replaces the denylist with an allowlist controlled by CUSTOM_MCP_ALLOWED_ENV_VARS and changes the default transport to SSE, requiring explicit opt-in to stdio via CUSTOM_MCP_PROTOCOL=stdio.
RemediationAI
Upgrade to Flowise 3.1.3 or later, available at https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3 via npm or Docker. The fix replaces the environment variable denylist with a strict allowlist: only variable names explicitly enumerated in the CUSTOM_MCP_ALLOWED_ENV_VARS environment variable (comma-separated, e.g., BRAVE_API_KEY,GITHUB_TOKEN) are permitted through to Custom MCP stdio servers - all others are rejected. The stdio protocol path is now opt-in only via CUSTOM_MCP_PROTOCOL=stdio; deployments that do not set this variable default to SSE, eliminating the stdio attack surface. For deployments that cannot immediately patch: set CUSTOM_MCP_PROTOCOL=sse to disable stdio transport entirely, which blocks this exploit at the cost of losing stdio-based MCP server support. Additionally, enable Flowise authentication (disabled by default) to require credentials before any MCP configuration can be submitted, reducing exposure to authenticated users only. Do not rely on CUSTOM_MCP_SECURITY_CHECK=true as a compensating control - this vulnerability demonstrates that the underlying security check is bypassable by design.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today