CVE-2026-91936

Flowise before version 3.1.4 ships GitHub Actions Docker image build workflows that interpolate workflow_dispatch inputs (such as tag_version and node_version) directly into shell run blocks without sanitization, allowing shell metacharacter injection (CWE-78). An attacker needs repository write access to trigger the flaw by dispatching the workflow with crafted input values, which then execute arbitrary commands on the CI runner. Because the runner holds AWS credentials and Docker Hub tokens, the attacker can exfiltrate those secrets and potentially publish poisoned container images, turning a build-pipeline flaw into a supply-chain risk for downstream Flowise users. The vulnerability affects the upstream Flowise repository and any forks that retained the vulnerable workflow; running Flowise deployments themselves are not directly exploitable via this issue. No public proof of concept exists, the flaw is not in CISA's KEV catalog, and no exploitation has been reported; the issue is fixed in Flowise 3.1.4.

What to do: Update to Flowise 3.1.4, which replaces the vulnerable workflow, and re-sync any forks that still carry the old Docker build workflow. Maintainers should refactor workflows to pass workflow_dispatch inputs via environment variables instead of direct string interpolation into run blocks, and restrict who can dispatch them. If the vulnerable workflow was ever run with untrusted input, audit runner logs for unexpected commands and rotate the exposed AWS credentials and Docker Hub tokens immediately.