Flowise: Authenticated RCE Via MCP Adapters

Description

Due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution.

Recommendation

Update the flowise-components package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.0.13
• Patched version(s): 3.1.0

References

• GHSA-c9gw-hvqq-f33r
• www.ox.security
• CVE-2026-40933
• CWE-78
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation - CVE-2026-69264
• Flowise: Code Injection in CSVAgent leads to Authenticated RCE - CVE-2026-41137
• Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) - CVE-2026-69263
• Flowise RCE via SQLite Record Manager Node - CVE-2026-69259

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

flowise-components