Skip to main content

Flowise EUVDEUVD-2026-57805

| CVE-2026-73601 CRITICAL
Eval Injection (CWE-95)
2026-08-13 VulnCheck GHSA-m2vg-4724-xj8g
Code Injection RCE Flowise
9.0
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.0 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.5 HIGH

Network-reachable but AC:H reflects the required non-default stdio config and validation-bypass crafting; PR:L for authenticated low-privilege user; S:C as execution escapes the app to the host OS with full C/I/A impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 13, 2026 - 13:01 EUVD
Analysis Generated
Aug 13, 2026 - 12:49 vuln.today
CVE Published
Aug 13, 2026 - 11:28 cve.org
CRITICAL 9.0

DescriptionCVE.org

Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and BROWSER environment variables with python3, or leverage the root working directory with node to bypass validation and execute system commands.

AnalysisAI

Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTOCOL is set to stdio - to run arbitrary OS commands on the host. By manipulating environment variables (PYTHONWARNINGS, BROWSER) passed to python3 or leveraging node with the root working directory, an attacker bypasses input validation and achieves command execution as the Flowise service account. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to Flowise with low-privileged account
Delivery
Configure Custom MCP node with stdio protocol
Exploit
Inject payload via PYTHONWARNINGS/BROWSER env or node root working dir
Execution
Bypass argument validation
Persist
Spawn python3/node executing directive
Impact
Execute arbitrary commands on host
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires an authenticated Flowise account (CVSS PR:L) with the ability to configure or run a Custom MCP node, AND the deployment must have CUSTOM_MCP_PROTOCOL set to stdio - this is the specific configuration prerequisite reflected by AT:P in the vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals broadly agree this is a real, high-priority issue for exposed instances, but with an important gating condition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a low-privileged authenticated Flowise account opens a flow using a Custom MCP node configured with the stdio protocol and supplies a python3 command whose PYTHONWARNINGS (or BROWSER) environment variable embeds a coded directive that Python evaluates on startup, or points node at a script via the unrestricted root working directory. When the node executes, the crafted directive bypasses validation and runs arbitrary OS commands on the Flowise host under the service account. …
Remediation Vendor-released patch: upgrade to Flowise 3.1.3 or later, which corrects the Custom MCP node validation. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all Flowise deployments and identify instances running versions before 3.1.3; verify CUSTOM_MCP_PROTOCOL configuration and immediately restrict network access to affected systems, disabling Custom MCP node if operationally feasible. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Flowise

View all
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2025-8943 CRITICAL POC
9.8 Aug 14

Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
CVE-2025-26319 CRITICAL POC
9.8 Mar 04

FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
CVE-2026-56274 HIGH POC
8.7 Jun 23

Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
CVE-2025-58434 CRITICAL POC
9.8 Sep 12

Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
CVE-2026-30821 CRITICAL POC
9.8 Mar 07

Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
CVE-2026-30824 CRITICAL POC
9.8 Mar 07

Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
CVE-2026-70470 CRITICAL POC
9.5 Aug 04

Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
CVE-2025-71334 CRITICAL POC
9.3 Jun 25

Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers

CVE-2026-46442 CRITICAL POC
9.4 Jun 08

Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key

CVE-2026-30820 HIGH POC
8.8 Mar 07

Privilege escalation in Flowise versions prior to 3.0.13 allows authenticated users to bypass API authorization by spoof
CVE-2026-30823 HIGH POC
8.8 Mar 07

Flowise versions up to 3.0.13 is affected by authorization bypass through user-controlled key (CVSS 8.8).

Same weakness CWE-95 – Eval Injection

View all
CVE-2025-24893 CRITICAL POC
9.8
CVE-2024-21650 CRITICAL POC
10.0
CVE-2013-10051 CRITICAL POC
9.3
CVE-2013-10070 CRITICAL POC
10.0
CVE-2026-33017 CRITICAL POC
9.3
CVE-2024-7954 CRITICAL POC
9.8
CVE-2024-36401 CRITICAL POC
9.8
CVE-2026-19626 CRITICAL POC
9.4

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

EUVD-2026-57805 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy