Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess

published 2026-05-14 5 mo ago modified 2026-07-08 4 mo ago also GHSA-m99r-2hxc-cp3q , EUVD-2026-38434

cvss: 9.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 7.5%; EPSS 7.5% chance of exploitation in 30 days, percentile 94%
public exploits: 1; Metasploit

Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restrictions. An attacker with a Flowise account of any role, or API access with view/update permissions for chatflows, can configure a malicious MCP server to bypass the validateCommandFlags blocklist (for example, 'docker build' is not blocked, and 'npx --yes' is not blocked while only '-y' is) and the validateArgsForLocalFileAccess checks, resulting in execution of arbitrary commands on the Flowise host.

Patch / fix

fixed in 4 links 1

npm flowise 3.1.2
npm flowise-components 3.1.2
Flowise Flowise 3.1.2
Flowise Flowise Components 3.1.2

github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2 release

Timeline

2026-05-14 Published
2026-06-23 First public exploit (Metasploit exploit/multi/http/flowise_mcp_rce)

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 4 mo ago (2026-06-23)

Exploit prediction

7.52% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/multi/http/flowise_mcp_rce Flowise MCP Server Remote Code Execution metasploit exploit, excellent rank, 2026-06-23
github.com https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-m99r-2hxc-cp3q referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	3.1	9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem	package	affected	fixed in
npm	flowise	<3.1.2	3.1.2
npm	flowise-components	<3.1.2	3.1.2

Affected products

Flowise Flowise
Flowise Flowise Components

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command
CWE-184 Incomplete List of Disallowed Inputs

References

github.com /FlowiseAI/Flowise/security/advisories/GHSA-m99r-2hxc-cp3q
vendor-advisory, exploit, web, third-party-advisory
vulncheck.com /advisories/flowise-remote-code-execution-via-mcp-security-bypass-in-validatecommandflags-and-validateargsforl
third-party-advisory
github.com /FlowiseAI/Flowise
package
github.com /FlowiseAI/Flowise/releases/tag/flowise%403.1.2
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary