Skip to content
OpenAdvisories

Product · Flowise

Flowise Components

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.9
    CVE-2026-56274 Public exploit

    Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess

    Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restrictions. An attacker with a Flowise account of any role, or API…

    Flowise Flowise Flowise Components flowise npm