Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12,000+ Instances Exposed

CVE-2025-26319 is an arbitrary file upload flaw (CWE-434) in the /api/v1/attachments API endpoint of FlowiseAI Flowise v2.2.6, a self-hosted open-source platform for building AI agent and LLM workflows. The endpoint accepts uploads without proper validation, and because the flaw is network-reachable with no authentication and no user interaction required (per the CVSS vector), a remote unauthenticated attacker can trigger it by sending crafted upload requests. The critical 9.8 score with high ratings for confidentiality, integrity, and availability indicates that successful abuse can lead to full compromise of the host, plausibly including remote code execution via uploaded files. Anyone running Flowise v2.2.6 is affected, and the risk is highest for instances exposed to the internet. Exploitation appears to be ongoing: a public proof-of-concept is available on GitHub, EPSS puts the 30-day exploitation probability at 55.9% (99th percentile), and security news reports attackers actively exploiting a critical Flowise flaw against the product's roughly 12,000+ internet-exposed instances.

Do: Upgrade Flowise to the latest release beyond v2.2.6 (no specific fixed version is stated in the available data, so verify the fix with the vendor's changelog), and keep internet exposure of /api/v1/attachments restricted — place Flowise behind a reverse proxy with authentication or limit it to trusted networks. Review servers for unexpected or recently created uploaded files and check access logs for unauthenticated POSTs to /api/v1/attachments as evidence of exploitation.

Flowise, an open-source drag-and-drop interface for building LLM agent flows, contains a critical remote code execution flaw (CWE-94, code injection) in its CustomMCP node. The node parses the user-supplied mcpServerConfig string, and the convertToValidJSONString helper passes this input directly to the JavaScript Function() constructor without any validation, causing it to be evaluated and executed as live code. Because the evaluation runs with full Node.js runtime privileges, an attacker can invoke dangerous modules such as child_process and fs to execute arbitrary commands on the host. Any Flowise deployment running version 3.0.5 or earlier is affected, and the CVSS vector (network attack vector, no privileges or user interaction required, scope change) indicates unauthenticated remote attackers can trigger it. Exploitation is active in the wild according to news reports citing roughly 12,000 exposed instances, and EPSS assigns an 87.4% probability of exploitation within 30 days.

Do: Upgrade Flowise to version 3.0.6 or later immediately. Given confirmed in-the-wild exploitation, review internet-exposed instances for signs of compromise (unexpected processes, spawned shells, or modified files) and restrict access to CustomMCP-configured instances behind authentication or a VPN until patched. The flaw is not yet listed in CISA KEV, but defenders should treat patching as urgent given the CVSS 10.0 rating and 87.4% EPSS score.

Flowise's Custom MCPs feature launches local MCP servers by executing operating-system commands (for example via npx), but Flowise has a minimal authentication and authorization model with no role-based access controls, and versions before 3.0.1 run without authentication by default unless it is explicitly configured. As a result, an unauthenticated attacker with network access to an affected instance can invoke this functionality to run unsandboxed OS commands. Successful exploitation yields full unauthenticated remote code execution on the host with the privileges of the Flowise service, with high impact to confidentiality, integrity, and availability (CVSS 3.1: 9.8). Any Flowise deployment prior to 3.0.1 is affected, with default, unauthenticated installations reachable from untrusted networks at greatest risk. JFrog has published technical details and a PoC, EPSS assigns a 66.3% probability of exploitation within 30 days (99th percentile), and news coverage reports active exploitation with 12,000+ instances exposed on the internet.

Do: Upgrade Flowise to version 3.0.1 or later. Until upgraded, restrict network access to the instance (firewall rules or an authenticating reverse proxy) and explicitly enable authentication, since default installations before 3.0.1 run without it. Review internet-exposed instances for signs of compromise, such as unexpected npx launches or child OS processes spawned by the Flowise service.