CVE-2026-91931

Flowise versions before 3.1.4 contain an operating system command injection flaw (CWE-78) in the Custom MCP node that allows authenticated users to achieve remote code execution on the Flowise server. An attacker triggers the flaw by supplying attacker-chosen npm package names in the mcpServerConfig parameter, which Flowise passes to npx, causing the malicious package to be downloaded and executed on the host. Successful exploitation gives full control of the Flowise server process, exposing API keys, credentials, chatbot data, and any connected systems, with CVSS v4.0 rated 9.0 (critical) despite requiring only low-privilege authentication. All deployments of Flowise prior to 3.1.4 that allow authenticated users to build or edit flows with the Custom MCP node are affected. No public proof-of-concept is known and the vulnerability is not in the CISA KEV catalog, but exploitation is plausible since Flowise instances are frequently shared among multiple low-trust users.

What to do: Upgrade Flowise to version 3.1.4 or later immediately. If immediate patching is not possible, restrict which authenticated users can create or edit flows using the Custom MCP node, and run Flowise in an isolated container with minimal privileges and no access to secrets beyond what is required. Review server logs for prior mcpServerConfig submissions referencing unusual npm package names or unexpected npx child processes to check for attempted or successful exploitation.