Flowise Remote Code Execution via Custom MCP Node

Executive Summary

This vulnerability is a remote code execution (RCE) flaw in Flowise versions before 3.1.3. It exists in the Custom MCP node when the CUSTOM_MCP_PROTOCOL is set to stdio. Authenticated users can exploit it by manipulating environment variables like PYTHONWARNINGS and BROWSER or abusing the root working directory with node to bypass validation and execute arbitrary system commands.

Useful 0 Not Useful 0

Detection Guidance

Check if Flowise is running with CUSTOM_MCP_PROTOCOL=stdio by inspecting environment variables or process configurations. Look for suspicious command execution patterns in logs, especially involving PYTHONWARNINGS, BROWSER, or HOME environment variables.

Useful 0 Not Useful 0

Impact Analysis

An attacker could fully compromise the Flowise application, leading to unauthorized access, data theft, or system manipulation. Since it requires authentication, the risk is limited to users with existing access, but the impact includes high confidentiality, integrity, and availability breaches.

Useful 0 Not Useful 0

Compliance Impact

This RCE vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's confidentiality requirements and HIPAA's safeguards for protected health information. Non-compliance risks include legal penalties, reputational damage, and mandatory breach notifications.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Flowise to version 3.1.3 or later. Change the default CUSTOM_MCP_PROTOCOL setting from stdio to sse in your configuration. Remove unnecessary environment variables like PYTHONWARNINGS and BROWSER if they are not required.

Useful 0 Not Useful 0