Skip to content
OpenAdvisories

Vendor

Flowise

25 known vulnerabilities.

Products

Flowise 25 Flowise Components 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.0
    CVE-2026-58057 Public exploit

    Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity

    Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitive comparison, so on Windows, where environment names are case-insensitive, supplying 'node_options' bypasses the NODE_OPTIONS denylist entry. An auth…

    Flowise Flowise
  • Critical 10.0
    CVE-2025-71338 Public exploit

    Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API

    Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and over…

    Flowise Flowise flowise npm
  • Critical 9.9
    CVE-2026-56274 Public exploit

    Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess

    Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restrictions. An attacker with a Flowise account of any role, or API…

    Flowise Flowise Flowise Components flowise npm