Flowise: Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Critical, CVSS 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Record
- CVE-2026-56274
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- June 25, 2026
Description
Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restrictions. An attacker with a Flowise account of any role, or API access with view/update permissions for chatflows, can configure a malicious MCP server to bypass the validateCommandFlags blocklist (for example, 'docker build' is not blocked, and 'npx --yes' is not blocked while only '-y' is) and the validateArgsForLocalFileAccess checks, resulting in execution of arbitrary commands on the Flowise host.
Description quoted from the NVD record.
Who is affected
Flowise is a tool for building apps that use AI language models. This flaw affects all versions before 3.1.2. The problem is in the Custom MCP Server feature, which lets a Flowise app connect to an outside tool server. Its safety checks on commands and on access to local files can be bypassed. Anyone with a Flowise account of any role, or with access through its programming interface (API) that can view or update chatflows (saved app workflows), could set up a harmful tool server. They could then run any commands they choose on the computer that hosts Flowise. This flaw is rated Critical.
What to do
- If you or someone on your staff installed and runs Flowise, that person should update it to version
3.1.2or later. - If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update will be done.
- If you are not sure whether your organization uses Flowise, ask whoever looks after your computers or online tools to check.
- For full details of the fix, see the vendor advisory linked on this page.
Analysis written from the source record as of June 25, 2026 and reviewed before publishing.