---
id: "GHSA-q2xp-j85q-883h"
kind: "vulnerability"
aliases: ["GHSA-q2xp-j85q-883h"]
title: "Duplicate Advisory: Flowise has unsandboxed remote code execution via Custom MCP"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "withdrawn"
category: "ai-tooling"
products: [{"name": "flowise", "fixed": ["3.0.6"], "affected": ">= 2.2.7-patch.1, < 3.0.6", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["ai-tooling", "cwe-78", "flowise", "mcp", "self-hosted"]
not_affected_if: ["auth-required", "flowise-3.0.6-or-later", "not-internet-exposed"]
published_at: "2026-06-26T00:32:05+00:00"
first_seen_at: "2026-11-03T17:36:46+00:00"
updated_at: "2026-11-03T17:38:31+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-q2xp-j85q-883h", "first_seen_at": "2026-11-03T17:36:46+00:00"}]
---

# Duplicate Advisory: Flowise has unsandboxed remote code execution via Custom MCP

Flowise's Custom MCP feature launches local processes from user-supplied JSON without sandboxing. A crafted request to the node-load-method endpoint with a special header lets an attacker run arbitrary OS commands on the server or container.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:flowise affected >= 2.2.7-patch.1, < 3.0.6 fixed 3.0.6

## How to check

- Check the installed version with `npm ls flowise` or the image tag, and compare it to the affected range `>= 2.2.7-patch.1, < 3.0.6`.
- Check whether `FLOWISE_USERNAME` and `FLOWISE_PASSWORD` are set in the environment; unset means no login is required.
- Check whether the instance is reachable from the internet.

## Fix

- `flowise` moves to `3.0.6` or later.

## Timeline

- 2026-11-03T17:36:46+00:00 ghsa https://github.com/advisories/GHSA-q2xp-j85q-883h

## From the sources

### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-6933-jpx5-q87q. This link is maintained to preserve external references.

### Original Description

Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal and lacks role-based access control, and the default installation runs without authentication unless FLOWISE_USERNAME and FLOWISE_PASSWORD are set, an attacker can send a crafted JSON payload with the header 'x-request-from: internal' to the /api/v1/node-load-method/customMCP endpoint to execute arbitrary OS commands, resulting in complete compromise of the platform container or server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_