{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aflowiseaiflowise/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2025-8943"},{"id":"CVE-2026-69263"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Flowise (3.1.2)","Flowise Components (3.1.2)","Flowise","Flowise (\u003c= 3.1.2)","flowise-components"],"_cs_severities":["critical"],"_cs_tags":["rce","injection","flowise","cve-2026-69263","python-injection","authentication-bypass","oauth","cve-2026-70478","web-vulnerability","broken-access-control","oauth2","arbitrary-file-write","path-traversal","privilege-escalation","web-application","secrets-disclosure"],"_cs_type":"advisory","_cs_vendors":["Flowise","FlowiseAI"],"content_html":"\u003cp\u003eFlowise (v3.1.2 and earlier) contains a critical security flaw involving an incomplete environment variable blocklist, identified as CVE-2026-69263. This vulnerability allows an attacker to bypass the intended security controls for the Model Context Protocol (MCP) server configuration, specifically those established in the previous CVE-2025-8943 patch. While the original patch successfully filtered dangerous CLI flags like \u003ccode\u003e-y\u003c/code\u003e for \u003ccode\u003enpx\u003c/code\u003e, it failed to account for \u003ccode\u003enpm\u003c/code\u003e configuration that can be passed via environment variables (e.g., \u003ccode\u003enpm_config_yes\u003c/code\u003e).\u003c/p\u003e\n\u003cp\u003eBecause Flowise defaults to an unauthenticated state, a remote attacker can interact with the API to register a malicious MCP server. By including specific environment variables in the configuration, an attacker can influence the behavior of \u003ccode\u003enpx\u003c/code\u003e, \u003ccode\u003enode\u003c/code\u003e, or \u003ccode\u003epython3\u003c/code\u003e to achieve remote code execution. This is a classic case of incomplete denylisting, where developers attempted to enumerate dangerous inputs rather than implementing a secure allowlist, leaving the environment vulnerable to various configuration injection vectors.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker discovers an internet-facing, unauthenticated Flowise instance.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the Flowise API to create or update an MCP server configuration.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a JSON payload containing the \u003ccode\u003emcpServers\u003c/code\u003e object with a command like \u003ccode\u003enpx\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker inserts environment variables such as \u003ccode\u003enpm_config_yes=true\u003c/code\u003e into the \u003ccode\u003eenv\u003c/code\u003e field of the payload.\u003c/li\u003e\n\u003cli\u003eFlowise validation logic (\u003ccode\u003evalidateCommandFlags\u003c/code\u003e) is bypassed because the CLI flags are clean.\u003c/li\u003e\n\u003cli\u003eFlowise validation logic (\u003ccode\u003evalidateEnvironmentVariables\u003c/code\u003e) is bypassed because the blocklist only contains four hardcoded entries (PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, NODE_OPTIONS).\u003c/li\u003e\n\u003cli\u003eFlowise spawns the \u003ccode\u003enpx\u003c/code\u003e process, which reads the injected environment variable and proceeds with automatic package installation.\u003c/li\u003e\n\u003cli\u003eMalicious code is executed under the privileges of the Flowise process, resulting in full system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in unauthenticated remote code execution on the server running Flowise. Given the tool's nature as an LLM integration platform, successful compromise often grants an attacker access to connected sensitive data, API keys for AI providers, and internal network resources. All versions up to and including 3.1.2 are confirmed to be vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to a version of Flowise that implements an allowlist-based validation approach for environment variables rather than a denylist.\u003c/li\u003e\n\u003cli\u003eImplement strict authentication on all Flowise API endpoints to prevent unauthenticated access to configuration interfaces.\u003c/li\u003e\n\u003cli\u003eRestrict outbound network access for the server running Flowise to prevent the automatic installation of arbitrary npm/pip packages from the internet.\u003c/li\u003e\n\u003cli\u003eEnsure that the service account running the Flowise process operates with the principle of least privilege, minimizing the damage from a successful code execution event.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-04T19:40:48Z","date_published":"2026-08-04T17:24:33Z","id":"https://feed.craftedsignal.io/briefs/2026-08-flowise-rce/","summary":"Flowise v3.1.2 and earlier are vulnerable to unauthenticated remote code execution because the CVE-2025-8943 patch relies on an incomplete environment variable blocklist, allowing attackers to inject configuration variables that force arbitrary package installation.","title":"Flowise Unauthenticated RCE via Environment Variable Bypass","url":"https://feed.craftedsignal.io/briefs/2026-08-flowise-rce/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-41264"},{"id":"CVE-2026-69255"},{"cvss":9.8,"id":"CVE-2026-41265"},{"cvss":9.9,"id":"CVE-2026-46442"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Flowise (\u003c= 3.1.2)","flowise-components (\u003c= 3.1.2)"],"_cs_severities":["critical"],"_cs_tags":["flowise","rce","prompt-injection"],"_cs_type":"advisory","_cs_vendors":["Flowise"],"content_html":"\u003cp\u003eFlowiseAI Flowise, a low-code tool for building customized large language model (LLM) applications, is vulnerable to remote code execution. Specifically, version 3.0.13 and earlier are affected. The vulnerability, identified by Trend Micro's Zero Day Initiative, stems from a lack of proper sandboxing when evaluating LLM-generated Python scripts within the \u003ccode\u003erun\u003c/code\u003e method of the \u003ccode\u003eCSV_Agents\u003c/code\u003e class. An unauthenticated attacker can exploit this vulnerability by injecting malicious code into prompts processed by the CSV Agent node, bypassing input validation to execute arbitrary OS commands on the server. Successful exploitation allows an attacker to execute code in the context of the user running the Flowise server. This impacts the confidentiality, integrity, and availability of the Flowise instance and the underlying system. The attack targets installations of Flowise on platforms like Ubuntu 25.10.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious prompt designed to exploit the CSV Agent node in Flowise.\u003c/li\u003e\n\u003cli\u003eThe attacker sends the crafted prompt to a chatflow that utilizes the vulnerable CSV Agent node.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003erun\u003c/code\u003e method of the \u003ccode\u003eCSV_Agents\u003c/code\u003e class is invoked, processing the attacker-supplied prompt.\u003c/li\u003e\n\u003cli\u003eThe system prompt, including the user's injected payload, is sent to an LLM to generate a Python script.\u003c/li\u003e\n\u003cli\u003eThe LLM generates a Python script containing malicious code, bypassing the \u003ccode\u003eFORBIDDEN_PATTERNS\u003c/code\u003e validation (e.g., importing \u003ccode\u003eos\u003c/code\u003e with an alias).\u003c/li\u003e\n\u003cli\u003eThe generated Python code, including the injected malicious commands (e.g., \u003ccode\u003epandas.system(\u0026quot;xcalc\u0026quot;)\u003c/code\u003e), is executed within a pyodide environment, lacking sufficient sandboxing.\u003c/li\u003e\n\u003cli\u003eThe attacker-controlled command is executed on the Flowise server, in the context of the user running the server.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves arbitrary code execution, potentially leading to system compromise, data exfiltration, or denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to execute arbitrary code on the Flowise server. This can lead to a full system compromise, allowing the attacker to steal sensitive data, install malware, or disrupt services. Given Flowise's role in LLM application development, a successful attack could compromise sensitive data used by these models, or introduce malicious functionality into the models themselves. The number of affected installations is unknown, but any Flowise instance running version 3.0.13 or earlier with the CSV Agent node exposed is potentially vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Flowise to a patched version greater than 3.0.13 to remediate CVE-2026-41264.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect Suspicious Flowise CSV Agent Execution\u0026quot; to detect attempts to exploit this vulnerability via process creation from unexpected locations.\u003c/li\u003e\n\u003cli\u003eReview and harden the \u003ccode\u003eFORBIDDEN_PATTERNS\u003c/code\u003e list in the \u003ccode\u003evalidatePythonCodeForDataFrame()\u003c/code\u003e function to prevent bypasses, referencing the details in the overview.\u003c/li\u003e\n\u003cli\u003eMonitor network connections originating from the Flowise server for suspicious outbound traffic using the \u0026quot;Detect Outbound Connection from Flowise Server\u0026quot; Sigma rule.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-04T17:24:01Z","date_published":"2024-01-02T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-flowise-rce/","summary":"A remote code execution vulnerability exists in FlowiseAI Flowise version 3.0.13 due to insufficient sandboxing when evaluating LLM-generated Python scripts, allowing unauthenticated attackers to inject malicious code via prompts processed by the CSV Agent node, bypassing input validation, to execute arbitrary OS commands.","title":"FlowiseAI Flowise CSV Agent Prompt Injection RCE Vulnerability","url":"https://feed.craftedsignal.io/briefs/2024-01-flowise-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}