CVE-2026-91931: Flowise before 3.1.4 Remote Code Execution via Custom MCP npx
Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code on the Flowise server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 3.1.4 - Configuration
Ensure mcpServerConfig does not accept attacker-controlled values for npx package names in the Custom MCP node.
Flowise (Custom MCP node) mcpServerConfig (npx package names) = Do not supply attacker-controlled npx package names
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs an authenticated Flowise account with the ability to supply the mcpServerConfig value for a Custom MCP node. No user interaction is required.
Which deployments are affected?
Flowise versions before 3.1.4 are affected where the Custom MCP node can be configured with attacker-controlled npx package names.
What is the impact of successful exploitation?
An attacker can cause npx to invoke an attacker-controlled npm package, resulting in arbitrary code execution on the Flowise server. The reported impact includes compromise of confidentiality, integrity, and availability.