CVE-2026-91931

Executive Summary

CVE-2026-91931 is a remote code execution vulnerability in Flowise (an open-source low-code platform for building LLM applications) affecting versions before 3.1.4. The flaw resides in the Custom MCP node, where authenticated attackers can supply an attacker-controlled npm package name via the mcpServerConfig parameter, causing the server to invoke npx and execute arbitrary code. With a CVSS score of 8.5, successful exploitation grants full compromise of confidentiality, integrity, and availability (scope-changing), meaning the impacted server can be used as a pivot point into the hosting environment.

Technical Analysis

Flowise is a Node.js-based visual builder for LLM orchestration that supports "nodes" — modular components that perform discrete tasks within a workflow. The Custom MCP (Model Context Protocol) node is designed to let users launch or connect to MCP servers, which are commonly distributed as npm packages and executed on demand through npx.

The vulnerability is an OS command injection (CWE-78) in the Custom MCP node's handling of the mcpServerConfig parameter. According to the NVD description, the node "allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter." The mechanism is that the package name supplied by the user is passed into an npx invocation without adequate validation or sandboxing, so npx resolves and executes whatever package the attacker specifies. Because npx fetches and runs packages from the npm registry by default, an attacker need only publish (or reference) a package containing a malicious postinstall/entry-point script, and the Flowise server will download and execute it with the privileges of the Flowise process.

Key characteristics derivable from the provided data:

• Attack surface: The Custom MCP node's configuration parameter mcpServerConfig, reachable by an authenticated user through the Flowise UI/API.
• Injection sink: The npx command. The exact command-construction pattern (e.g., shell concatenation vs. argument-array spawn) is not specified in the source data, and no further implementation details are asserted here.
• Authentication requirement: Low privileges (PR:L) are required — an attacker needs a valid authenticated session on the Flowise instance. This is typical of LLM-application builders where default installations often expose self-registration or default credentials.
• Attack complexity: High (AC:H), suggesting the exploit path may depend on environmental conditions such as network access from the server to the npm registry, the specific package resolution behavior, or preconditions in node configuration.
• Scope change (S:C): The vulnerable component (Flowise) executes code that escapes the intended security authority of the MCP node, affecting resources beyond the Flowise application itself — consistent with arbitrary code execution on the host.

No CVE metadata is provided for the vulnerable version's exact source line, and no public advisory text beyond the NVD description was supplied; therefore this analysis stays at the vulnerability-class and mechanism level and does not assert specific function names, URLs, or file paths.

Exploitation Scenarios

No public proof-of-concept is available as of this writing. The chain below is inferred from the vulnerability class (OS command injection via npx) and the explicit NVD description. No specific function names, file paths, or API endpoints are asserted beyond those listed in the source data.

1) Reconnaissance / target identification. An attacker identifies an internet- or intranet-accessible Flowise instance running a version prior to 3.1.4. Flowise UIs are commonly exposed on HTTP(S) behind reverse proxies or directly on a Node port. Fingerprinting can target the Flowise title/branding in the web UI. The attacker must obtain an authenticated session (valid account, self-registration if enabled, or leaked/default credentials), since the flaw requires PR:L.

2) Triggering the flaw class. The attacker creates or edits a chatflow/workflow containing the Custom MCP node. In the node configuration, the attacker sets the mcpServerConfig parameter to reference an attacker-controlled npm package name. When the node is initialized/executed, the platform invokes npx with that package name — the untrusted input flows into a command-execution context with no effective allow-listing of trusted packages.

3) Payload / execution method (vulnerability-class level). At the class level, OS command injection into an npx invocation enables arbitrary code execution. Concretely, an attacker can use a package name that npx resolves to attacker-published code (e.g., a package whose install or entrypoint script performs actions on the host). Because npx may reach the public npm registry, the attacker does not need filesystem write access — they only need a package under their control and network egress from the Flowise server to the registry. Command-injection characters could also permit shell-level execution depending on how npx is invoked, but the source data does not confirm the parameterization pattern, so shell-metacharacter abuse is stated only as a class-level possibility, not a confirmed implementation detail.

4) Post-exploitation impact. Successful execution runs in the security context of the Flowise Node process. From there, an attacker can read environment variables (frequently containing LLM API keys, database credentials, and storage secrets), access connected databases and vector stores, pivot to internal services reachable from the host, establish persistence, and exfiltrate data. The scope-changing nature of the CVSS vector reflects that impact extends beyond the vulnerable component to the host and the broader environment.

Impact Assessment

• Confidentiality: High — API keys, database credentials, customer data processed by LLM workflows, and internal configuration are exposed.
• Integrity: High — the attacker can modify workflow definitions, deployed models, and any data the Flowise process can write to.
• Availability: High — arbitrary code execution permits resource exhaustion, data destruction, or service shutdown.
• Scope: Changed (S:C) — impact crosses a trust boundary; the host environment and adjacent services are at risk, not just the Flowise application.
• Privileges Required: Low — requires an authenticated account, which lowers the barrier where self-registration is open or default credentials are unchanged.
• Blast radius: Flowise is often deployed as a shared internal service connecting to numerous LLM providers, databases, and vector stores. A compromised instance can become a pivot into those downstream systems, and — because it aggregates credentials — a high-value single point of compromise. Multi-tenant deployments, in particular, risk cross-tenant data exposure if the server holds multiple tenants' secrets.

Business impact includes credential compromise, potential data breach disclosure obligations, supply-chain-style risk to downstream consumers of attacker-hosted packages, and disruption of any production applications depending on the Flowise workflows.

Detection Guidance

Sigma Rule

title: Flowise Custom MCP Node npx Command Injection Attempt
id: 9f3a2c1e-7b4d-4e2a-9c1f-flow91831mcp
status: experimental
description: Detects potential exploitation of CVE-2026-91931 via attacker-controlled npm package names passed to npx in Flowise Custom MCP node configuration.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91931
author: valtersit.com
date: 2026/01/01
tags:
  - attack.execution
  - attack.t1059
  - cve.2026-91931
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/npx'
      - '\npx.cmd'
  selection_parent:
    ParentImage|contains:
      - 'node'
  selection_suspicious:
    CommandLine|contains:
      - 'mcpServerConfig'
      - 'npx'
  condition: selection_proc and selection_parent and selection_suspicious
fields:
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate use of custom MCP nodes with trusted npm packages
level: high

YARA Rule

rule CVE_2026_91931_Flowise_MCP_npx_Injection
{
    meta:
        description = "Detects Flowise Custom MCP node configuration referencing attacker-controlled npx packages (CVE-2026-91931)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91931"
        severity = "high"

    strings:
        $p1 = "mcpServerConfig" ascii wide nocase
        $p2 = "Custom MCP" ascii wide nocase
        $n1 = "npx" ascii wide
        $n2 = "npm install" ascii wide
        $c1 = ";" ascii
        $c2 = "&&" ascii
        $c3 = "|" ascii

    condition:
        ($p1 or $p2) and ($n1 or $n2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91931 Flowise Custom MCP npx Package Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"mcp" nocase; http.request_body; content:"mcpServerConfig"; nocase; http.request_body; content:"npx"; nocase; reference:cve,2026-91931; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91931; classtype:attempted-admin; sid:202691931; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, created_by valtersit.com;)

Elastic Detection

process where process.name in ("npx", "npx.cmd") and
  process.parent.name == "node" and
  process.command_line : ("*mcpServerConfig*" or "*mcp-server*") and
  process.args_count > 0

Splunk SPL Query

index=flowise OR index=nodejs sourcetype=process:*
(process_name="npx" OR process_name="npx.cmd")
| search (command_line="*mcpServerConfig*" OR command_line="*npx*package*")
| stats count min(_time) as firstTime max(_time) as lastTime values(command_line) as commands by host, user, process_name
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`

Wazuh OSSEC Rule

<group name="flowise,cve-2026-91931,">
  <rule id="202691931" level="12">
    <decoded_as>json</decoded_as>
    <field name="process.name">npx|npx.cmd</field>
    <field name="process.parent.name">node</field>
    <field name="process.command_line">mcpServerConfig</field>
    <description>CVE-2026-91931: Flowise Custom MCP node invoking npx with attacker-controlled package name</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>execution,cve_2026_91931,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). Upgrade carefully and verify after deployment.

1) Immediate mitigations

• Restrict access to the Flowise UI/API to trusted networks; do not expose instances to the internet.
• Disable or remove the Custom MCP node from workflow templates if it is not operationally required.
• Enforce authentication hygiene: disable self-registration, rotate default credentials, and apply least privilege to Flowise accounts (limits who can reach PR:L exploitation).
• Restrict outbound network egress from the Flowise server so npx cannot reach the public npm registry; use an internal, curated registry mirror if MCP packages are required.
• Monitor process creation logs for npx spawned by the Node process with unexpected package arguments.

2) Patch / upgrade steps

• Upgrade Flowise to 3.1.4 or later, which the OSV source indicates addresses this issue. Because patch confidence is only 2/4, validate the fix in a staging environment before production rollout and confirm the Custom MCP node no longer accepts attacker-controlled package names.
• After upgrade, re-review any existing Custom MCP node configurations for unexpected package references.

3) Long-term hardening

• Apply input allow-listing for MCP package names rather than relying on npx to resolve arbitrary packages.
• Run Flowise in a container/VM with a read-only filesystem, no host secrets in environment variables, and no broad network reachability.
• Store LLM/API credentials in a secrets manager with short-lived tokens instead of plaintext environment variables.
• Adopt an SBOM/dependency-review process and monitor npm for typosquatted packages targeting MCP/Flowise.

References

• NVD — CVE-2026-91931: https://nvd.nist.gov/vuln/detail/CVE-2026-91931
• OSV — package advisory referencing CVE-2026-91931 (patch claim source, Flowise < 3.1.4): https://osv.dev/list?q=CVE-2026-91931
• Flowise project repository and release notes (verify 3.1.4 fix): https://github.com/FlowiseAI/Flowise/releases
• MITRE ATT&CK T1059 — Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
• CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html

Threat actor / in-the-wild note: CISA KEV status is NO. No public PoC, exploit code, or Nuclei template was identified at the time of writing. No specific threat actor campaigns are known to be associated with this CVE based on the provided intelligence. EPSS has not yet been scored by FIRST.org; no EPSS value is asserted here.