Because Flowise defaults to an unauthenticated state, a remote attacker can interact with the API to register a malicious MCP server. By including specific environment variables in the configuration, an attacker can influence the behavior of npx, node, or python3 to achieve remote code execution. This is a classic case of incomplete denylisting, where developers attempted to enumerate dangerous inputs rather than implementing a secure allowlist, leaving the environment vulnerable to various configuration injection vectors.

Attack Chain

1. Attacker discovers an internet-facing, unauthenticated Flowise instance.
2. Attacker interacts with the Flowise API to create or update an MCP server configuration.
3. Attacker crafts a JSON payload containing the mcpServers object with a command like npx.
4. Attacker inserts environment variables such as npm_config_yes=true into the env field of the payload.
5. Flowise validation logic (validateCommandFlags) is bypassed because the CLI flags are clean.
6. Flowise validation logic (validateEnvironmentVariables) is bypassed because the blocklist only contains four hardcoded entries (PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, NODE_OPTIONS).
7. Flowise spawns the npx process, which reads the injected environment variable and proceeds with automatic package installation.
8. Malicious code is executed under the privileges of the Flowise process, resulting in full system compromise.

Impact

Successful exploitation results in unauthenticated remote code execution on the server running Flowise. Given the tool's nature as an LLM integration platform, successful compromise often grants an attacker access to connected sensitive data, API keys for AI providers, and internal network resources. All versions up to and including 3.1.2 are confirmed to be vulnerable.

Recommendation

1. Upgrade to a version of Flowise that implements an allowlist-based validation approach for environment variables rather than a denylist.
2. Implement strict authentication on all Flowise API endpoints to prevent unauthenticated access to configuration interfaces.
3. Restrict outbound network access for the server running Flowise to prevent the automatic installation of arbitrary npm/pip packages from the internet.
4. Ensure that the service account running the Flowise process operates with the principle of least privilege, minimizing the damage from a successful code execution event.

Attack Chain

1. The attacker authenticates to the Flowise application, or bypasses authentication by setting the x-request-from header.
2. The attacker crafts a malicious payload containing Python code for execution, embedding OS commands such as whoami. Example: DataFrame({'foo': ['bar!']});import os;os.system('whoami').
3. The attacker creates a new chat flow via a POST request to /api/v1/chatflows, including a CSVAgent node with the malicious payload in the customReadCSV field.
4. The server saves the attacker-controlled customReadCSV code within the chat flow definition.
5. The attacker triggers the execution of the crafted chat flow by sending a POST request to /api/v1/prediction/[CHATFLOWID], which invokes the CSVAgent.
6. The pyodide.runPythonAsync function executes the injected code due to insufficient sanitization of the customReadCSV input.
7. The injected code executes arbitrary OS commands on the server.
8. The attacker gains full control of the Flowise server.

Impact

Successful exploitation of this vulnerability results in Remote Code Execution (RCE) on the Flowise server. This allows an attacker to execute arbitrary commands, potentially leading to complete system compromise. Affected versions include Flowise and Flowise-components up to and including version 3.0.13. The impact is critical, as it allows for unauthorized access and control of the server infrastructure.

Recommendation

• Upgrade Flowise and Flowise-components to a version higher than 3.0.13 to patch the vulnerability (GHSA-9wc7-mj3f-74xv).
• Enforce strong authentication and authorization policies for the Flowise application to prevent unauthorized access and exploitation.
• Deploy the Sigma rule Detect Flowise CSVAgent RCE Attempt via Malicious customReadCSV to identify exploitation attempts based on suspicious strings in HTTP request bodies targeting the /api/v1/chatflows endpoint.
• Monitor web server logs for POST requests to /api/v1/chatflows and /api/v1/prediction with suspicious code-like strings in the request body, especially within the customReadCSV parameter.