AI description
CVE-2026-40933 is a remote code execution (RCE) vulnerability identified in Flowise, an open-source platform designed for building large language model (LLM) flows through a drag-and-drop interface. The flaw originates from the unsafe serialization of stdio commands within the Model Context Protocol (MCP) adapter. This allows an authenticated attacker to introduce an MCP stdio server containing arbitrary commands, leading to command execution on the underlying operating system. The vulnerability, present in Flowise versions prior to 3.1.0, enables attackers to bypass existing input sanitization checks. By leveraging legitimate commands, such as "npx," in conjunction with code execution arguments, malicious commands can be executed. Exploitation can occur if an authenticated user adds a new MCP with a malicious stdio configuration, or if a user is convinced to import a specially crafted chatflow, which then triggers arbitrary code execution upon rendering.
- Description
- Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution. The vulnerability lies in a bug in the input sanitization from the “Custom MCP” configuration in http://localhost:3000/canvas - where any user can add a new MCP, when doing so - adding a new MCP using stdio, the user can add any command, even though your code have input sanitization checks such as validateCommandInjection and validateArgsForLocalFileAccess, and a list of predefined specific safe commands - these commands, for example "npx" can be combined with code execution arguments ("-c touch /tmp/pwn") that enable direct code execution on the underlying OS. This vulnerability is fixed in 3.1.0.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
- Products
- flowise
CVSS 3.1
- Type
- Secondary
- Base score
- 9.9
- Impact score
- 6
- Exploitability score
- 3.1
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Severity
- CRITICAL
- security-advisories@github.com
- CWE-78
- Hype score
- Not currently trending
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CB30DB8F-4F72-4FD3-90FB-8331F1CBB78E",
"versionEndExcluding": "3.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]