CVE-2026-91936: Flowise before 3.1.4 Script Injection via Docker Workflows
Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflowdispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tagversion and nodeversion to execute arbitrary commands and steal AWS credentials and Docker Hub tokens.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 3.1.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs write access to the repository so they can supply malicious workflow_dispatch input values, such as tag_version or node_version. It is therefore primarily exposed in repositories where write permissions are granted to untrusted or insufficiently trusted contributors.
What could an attacker gain from successful exploitation?
Injected shell commands can run in the Docker image build workflow context. The advisory states that this can be used to steal AWS credentials and Docker Hub tokens available to that workflow.
Which configurations are affected?
The affected workflow pattern directly interpolates workflow_dispatch inputs into shell run blocks. Versions before 3.1.4 are affected when their Docker image build workflows use this pattern.
What should be prioritized if an immediate upgrade is not possible?
Restrict repository write access to trusted users, because write access is the stated prerequisite for supplying the malicious workflow inputs. Treat AWS credentials and Docker Hub tokens accessible to these workflows as potentially exposed if suspicious workflow runs occurred.