Description
Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override bypass using the FILE-STORAGE:: keyword combined with a NODE_OPTIONS environment variable injection.
Recommendation
Update the flowise-components package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.0.13
- Patched version(s): 3.1.0
References
Could your website be exposed too?
SmartScanner can check your website for Flowise: Parameter Override Bypass Remote Command Execution and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability - CVE-2026-41265
- Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - CVE-2026-41264
- Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas - CVE-2026-41138
- Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - flowise-components - CVE-2026-70477
You might also like:
See something that needs correcting? Let us knowUpdated April 24, 2026