{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/flowise-components/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-69263"},{"id":"CVE-2026-70476"},{"id":"CVE-2026-70471"},{"cvss":7.6,"id":"CVE-2026-67621"},{"cvss":7.7,"id":"CVE-2026-67620"},{"cvss":7.5,"id":"CVE-2026-71962"},{"cvss":7.5,"id":"CVE-2026-70636"},{"id":"CVE-2026-70478"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Flowise (3.1.2)","Flowise Components (3.1.2)","Flowise","Flowise (\u003c= 3.1.2)","flowise-components","Flowise (\u003c= 3.1.4)","Flowise (2.2.4-3.1.4)"],"_cs_severities":["critical"],"_cs_tags":["rce","injection","flowise","cve-2026-69263","python-injection","authentication-bypass","oauth","cve-2026-70478","web-vulnerability","broken-access-control","oauth2","arbitrary-file-write","path-traversal","privilege-escalation","web-application","secrets-disclosure"],"_cs_type":"advisory","_cs_vendors":["Flowise","FlowiseAI"],"content_html":"\u003cp\u003eFlowise (v3.1.2 and earlier) contains a critical security flaw involving an incomplete environment variable blocklist, identified as CVE-2026-69263. This vulnerability allows an attacker to bypass the intended security controls for the Model Context Protocol (MCP) server configuration, specifically those established in the previous CVE-2025-8943 patch. While the original patch successfully filtered dangerous CLI flags like \u003ccode\u003e-y\u003c/code\u003e for \u003ccode\u003enpx\u003c/code\u003e, it failed to account for \u003ccode\u003enpm\u003c/code\u003e configuration that can be passed via environment variables (e.g., \u003ccode\u003enpm_config_yes\u003c/code\u003e).\u003c/p\u003e\n\u003cp\u003eBecause Flowise defaults to an unauthenticated state, a remote attacker can interact with the API to register a malicious MCP server. By including specific environment variables in the configuration, an attacker can influence the behavior of \u003ccode\u003enpx\u003c/code\u003e, \u003ccode\u003enode\u003c/code\u003e, or \u003ccode\u003epython3\u003c/code\u003e to achieve remote code execution. This is a classic case of incomplete denylisting, where developers attempted to enumerate dangerous inputs rather than implementing a secure allowlist, leaving the environment vulnerable to various configuration injection vectors.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker discovers an internet-facing, unauthenticated Flowise instance.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the Flowise API to create or update an MCP server configuration.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a JSON payload containing the \u003ccode\u003emcpServers\u003c/code\u003e object with a command like \u003ccode\u003enpx\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker inserts environment variables such as \u003ccode\u003enpm_config_yes=true\u003c/code\u003e into the \u003ccode\u003eenv\u003c/code\u003e field of the payload.\u003c/li\u003e\n\u003cli\u003eFlowise validation logic (\u003ccode\u003evalidateCommandFlags\u003c/code\u003e) is bypassed because the CLI flags are clean.\u003c/li\u003e\n\u003cli\u003eFlowise validation logic (\u003ccode\u003evalidateEnvironmentVariables\u003c/code\u003e) is bypassed because the blocklist only contains four hardcoded entries (PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, NODE_OPTIONS).\u003c/li\u003e\n\u003cli\u003eFlowise spawns the \u003ccode\u003enpx\u003c/code\u003e process, which reads the injected environment variable and proceeds with automatic package installation.\u003c/li\u003e\n\u003cli\u003eMalicious code is executed under the privileges of the Flowise process, resulting in full system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in unauthenticated remote code execution on the server running Flowise. Given the tool's nature as an LLM integration platform, successful compromise often grants an attacker access to connected sensitive data, API keys for AI providers, and internal network resources. All versions up to and including 3.1.2 are confirmed to be vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to a version of Flowise that implements an allowlist-based validation approach for environment variables rather than a denylist.\u003c/li\u003e\n\u003cli\u003eImplement strict authentication on all Flowise API endpoints to prevent unauthenticated access to configuration interfaces.\u003c/li\u003e\n\u003cli\u003eRestrict outbound network access for the server running Flowise to prevent the automatic installation of arbitrary npm/pip packages from the internet.\u003c/li\u003e\n\u003cli\u003eEnsure that the service account running the Flowise process operates with the principle of least privilege, minimizing the damage from a successful code execution event.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-10T19:36:04Z","date_published":"2026-08-04T17:24:33Z","id":"https://feed.craftedsignal.io/briefs/2026-08-flowise-rce/","summary":"Flowise v3.1.2 and earlier are vulnerable to unauthenticated remote code execution because the CVE-2025-8943 patch relies on an incomplete environment variable blocklist, allowing attackers to inject configuration variables that force arbitrary package installation.","title":"Flowise Unauthenticated RCE via Environment Variable Bypass","url":"https://feed.craftedsignal.io/briefs/2026-08-flowise-rce/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Flowise","Flowise-components"],"_cs_severities":["critical"],"_cs_tags":["code-injection","rce","flowise"],"_cs_type":"advisory","_cs_vendors":["Flowise"],"content_html":"\u003cp\u003eFlowise, an open-source visual AI workflow tool, is vulnerable to a critical remote code execution (RCE) flaw in versions 3.0.13 and earlier. The vulnerability exists within the CSVAgent component, where the \u003ccode\u003ecustomReadCSVFunc\u003c/code\u003e parameter is not properly sanitized. This allows an authenticated attacker to inject arbitrary code into the \u003ccode\u003ecode\u003c/code\u003e variable, which is then executed by the \u003ccode\u003epyodide\u003c/code\u003e library on the server. The attack requires authentication but can be bypassed if \u003ccode\u003eFLOWISE_USERNAME\u003c/code\u003e and \u003ccode\u003eFLOWISE_PASSWORD\u003c/code\u003e are not set and the attacker provides the \u003ccode\u003e\u0026quot;x-request-from\u0026quot;: \u0026quot;internal\u0026quot;\u003c/code\u003e header. Successful exploitation grants the attacker the ability to execute arbitrary commands on the underlying server, leading to a complete system compromise. The vulnerability was disclosed in GitHub Advisory GHSA-9wc7-mj3f-74xv.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker authenticates to the Flowise application, or bypasses authentication by setting the \u003ccode\u003ex-request-from\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious payload containing Python code for execution, embedding OS commands such as \u003ccode\u003ewhoami\u003c/code\u003e. Example: \u003ccode\u003eDataFrame({'foo': ['bar!']});import os;os.system('whoami')\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker creates a new chat flow via a \u003ccode\u003ePOST\u003c/code\u003e request to \u003ccode\u003e/api/v1/chatflows\u003c/code\u003e, including a CSVAgent node with the malicious payload in the \u003ccode\u003ecustomReadCSV\u003c/code\u003e field.\u003c/li\u003e\n\u003cli\u003eThe server saves the attacker-controlled \u003ccode\u003ecustomReadCSV\u003c/code\u003e code within the chat flow definition.\u003c/li\u003e\n\u003cli\u003eThe attacker triggers the execution of the crafted chat flow by sending a \u003ccode\u003ePOST\u003c/code\u003e request to \u003ccode\u003e/api/v1/prediction/[CHATFLOWID]\u003c/code\u003e, which invokes the CSVAgent.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003epyodide.runPythonAsync\u003c/code\u003e function executes the injected code due to insufficient sanitization of the \u003ccode\u003ecustomReadCSV\u003c/code\u003e input.\u003c/li\u003e\n\u003cli\u003eThe injected code executes arbitrary OS commands on the server.\u003c/li\u003e\n\u003cli\u003eThe attacker gains full control of the Flowise server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in Remote Code Execution (RCE) on the Flowise server. This allows an attacker to execute arbitrary commands, potentially leading to complete system compromise. Affected versions include Flowise and Flowise-components up to and including version 3.0.13. The impact is critical, as it allows for unauthorized access and control of the server infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Flowise and Flowise-components to a version higher than 3.0.13 to patch the vulnerability (GHSA-9wc7-mj3f-74xv).\u003c/li\u003e\n\u003cli\u003eEnforce strong authentication and authorization policies for the Flowise application to prevent unauthorized access and exploitation.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Flowise CSVAgent RCE Attempt via Malicious customReadCSV\u003c/code\u003e to identify exploitation attempts based on suspicious strings in HTTP request bodies targeting the \u003ccode\u003e/api/v1/chatflows\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for POST requests to \u003ccode\u003e/api/v1/chatflows\u003c/code\u003e and \u003ccode\u003e/api/v1/prediction\u003c/code\u003e with suspicious code-like strings in the request body, especially within the \u003ccode\u003ecustomReadCSV\u003c/code\u003e parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-10-26T12:00:00Z","date_published":"2024-10-26T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-10-flowise-rce/","summary":"Flowise versions 3.0.13 and earlier are vulnerable to authenticated remote code execution due to missing sanitization in the CSVAgent component's customReadCSVFunc parameter, leading to arbitrary code injection and server compromise.","title":"Flowise CSVAgent Authenticated Remote Code Execution","url":"https://feed.craftedsignal.io/briefs/2024-10-flowise-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Flowise-Components","version":"https://jsonfeed.org/version/1.1"}