CVE-2025-8943 in the critical feed json
Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers
published 2025-08-14 14 mo ago modified 2026-06-17 4 mo ago also GHSA-2vv2-3x8x-4gv7 , EUVD-2025-24801
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 75.3%
- EPSS 75.3% chance of exploitation in 30 days, percentile 99.5%
- public exploits
- 1
- Metasploit, plus a Nuclei check
Summary
The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.
Patch / fix
- flowiseai flowise 3.0.1
Timeline
- First public exploit (Metasploit exploit/multi/http/flowise_custommcp_rce)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 14 mo ago
Exploit prediction
75.30% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/flowise_custommcp_rce Flowise Custom MCP Remote Code Execution metasploit exploit, excellent rank, 2025-08-14
- Nuclei template Flowise < 3.0.1 - Remote Command Execution nuclei detection template
- research.jfrog.com https://research.jfrog.com/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | flowise | <=3.0.5 |
no fix listed |
Classification
References
-
research.jfrog.com
/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578/
third-party-advisory, exploit
-
nvd.nist.gov
/vuln/detail/CVE-2025-8943
advisory
-
github.com
/FlowiseAI/Flowise
package
-
research.jfrog.com
/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578
web
Sources
- CVE List CVE-2025-8943
- GitHub Advisory GHSA-2vv2-3x8x-4gv7
- NVD CVE-2025-8943
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.