CVE-2026-91936

Executive Summary

CVE-2026-91936 is a script (OS command) injection vulnerability in Flowise versions prior to 3.1.4, affecting GitHub Actions workflow_dispatch inputs that are directly interpolated into shell run blocks during Docker image build workflows. An attacker with repository write access can inject shell metacharacters via the tag_version and node_version inputs to execute arbitrary commands in the CI/CD runner context, enabling theft of AWS credentials and Docker Hub tokens. The vulnerability is scored CVSS 3.1 6.8 (Medium) and carries a low EPSS score (0.00348, 28.3rd percentile), with no public PoC, no Nuclei template, and no evidence of CISA KEV inclusion or in-the-wild exploitation.

Technical Analysis

Vulnerability class. CVE-2026-91936 is an OS command injection flaw (CWE-78) arising from improper neutralization of special elements used in an OS command. The specific anti-pattern is a classic CI/CD expression-injection sink: workflow_dispatch inputs are accepted as attributes of the github.event.inputs context and then referenced directly inside a shell run: block rather than being passed through an intermediate env: variable and quoted. The NVD description states that "workflow_dispatch inputs are directly interpolated into shell run blocks."

Attack surface. The affected attack surface is the repository's Docker image build workflow, triggered via GitHub's workflow_dispatch event. The vulnerable inputs named in the description are tag_version and node_version. Because these values are concatenated into a shell command string, any shell metacharacter sequence (command separators, command substitution, pipes, redirection, backticks) becomes executable within the runner's shell process.

Mechanism. When a user triggers the workflow with attacker-controlled values for tag_version or node_version, the GitHub Actions runner performs string interpolation before the shell parses the command. The shell therefore interprets injected metacharacters as separate commands or command substitutions, executing them in the context of the CI job. Because the job is building/publishing container images, the runner environment typically exposes registry and cloud credentials — here, AWS credentials and Docker Hub tokens — making the outcome credential exfiltration rather than simple command execution.

Blast radius considerations. The CVSS vector S:C (Scope: Changed) reflects that exploitation escapes the intended security authority of the vulnerable component: code supplied as a "version string" executes as arbitrary commands on the runner, affecting resources beyond the immediate scope of the input field (the CI environment, cloud/registry accounts, and any downstream artifacts the runner can publish). C:N (Confidentiality: None) is notable in the vector even though the description explicitly cites credential theft — analysts should reconcile this by noting the vector appears to treat confidentiality impact at the vulnerable component level; the practical impact of credential exfiltration is nonetheless significant for downstream systems. I:H reflects high integrity impact (arbitrary command execution, artifact tampering). No user interaction is required (UI:N) and no privileges beyond repository write access are needed (PR:H), but PR:H materially narrows the practical threat model: the attacker must already be able to trigger workflow_dispatch (write access to the repository or equivalent).

Patch status. Per OSV, Flowise 3.1.4 addresses the issue. This is a single-source claim (Patch Confidence 2/4 — CLAIMED) and has not been independently confirmed against the vendor's own advisory or repository commit history.

Exploitation Scenarios

Note: No public PoC is available. The following chain is inferred from the vulnerability class (CWE-78 in GitHub Actions workflow_dispatch interpolation) and the mechanism explicitly described in the NVD description. No function names, endpoints, or parameters beyond tag_version and node_version are asserted.

1. Reconnaissance / target identification. The attacker identifies a Flowise deployment or fork whose repository runs a Docker image build workflow gated on workflow_dispatch and which accepts tag_version and node_version inputs. Because workflow_dispatch requires elevated permission (repository write), reconnaissance focuses on identifying repositories where the attacker already has a foothold — a compromised contributor account, a malicious insider, or a supply-chain position — rather than unauthenticated internet-wide scanning of the running application.

2. Triggering the flaw. The attacker invokes the workflow through the GitHub UI or API, supplying a crafted value for tag_version or node_version that contains shell metacharacters (e.g., command separators, command substitution syntax, or pipes). Because the input is interpolated directly into the run block, the runner's shell parses the injected characters as part of the command.

3. Execution method (vulnerability-class level). The injected metacharacters cause the shell to execute attacker-chosen commands inline with the legitimate build command. No specific function, file path, or API endpoint is asserted here beyond the two named inputs; the execution primitive is simply "arbitrary shell command in the CI runner."

4. Post-exploitation impact. The NVD description states the objective is to "steal AWS credentials and Docker Hub tokens." With those secrets, an attacker can:

• Push malicious images to the project's Docker Hub namespace (supply-chain poisoning for downstream consumers).
• Access or modify AWS resources permitted by the compromised role/keys.
• Persist access beyond the workflow run by moving stolen credentials out-of-band.

Disruption to the integrity of build artifacts (I:H) is the primary scored impact; credential theft extends the blast radius to any system trusting those credentials.

Impact Assessment

Business impact. The direct impact is integrity compromise of the CI/CD pipeline (I:H) and exfiltration of high-value secrets (AWS credentials, Docker Hub tokens) that the pipeline legitimately uses. Downstream, this is a supply-chain risk: tampered images or artifacts could affect every consumer of the published output. The changed-scope metric (S:C) captures that the exploited authority (CI runner) is broader than the vulnerable input field.

Affected systems. Any Flowise deployment or repository running the affected Docker image build workflow before version 3.1.4, and any organization whose CI pipeline trusts the stolen credentials.

Blast radius. Limited by PR:H — a valid repository-write position is a prerequisite, which excludes unauthenticated remote exploitation. The primary exposure is to organizations that accept external contributions, run forks with secrets available, or permit broad write access. No public exploit, no Nuclei template, no confirmed in-the-wild activity, and a low EPSS score (0.00348) all indicate low current exploitation likelihood, but the credential-theft outcome makes pre-emptive remediation worthwhile.

CVSS subscores referenced: AV:N (network-triggerable via API), AC:L (no special conditions), PR:H (write access), UI:N (no victim interaction), S:C, C:N, I:H, A:N.

Detection Guidance

Sigma Rule

title: Flowise Docker Build Workflow Command Injection via workflow_dispatch Inputs
id: 9b1f7c2a-3d4e-4f5a-8b6c-1e2d3f4a5b6c
status: experimental
description: Detects suspicious shell metacharacters or credential-access commands in GitHub Actions workflow_dispatch input processing for Flowise Docker image builds (CVE-2026-91936).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91936
author: valtersit.com
date: 2026-01-01
logsource:
  product: github
  service: audit
detection:
  selection_event:
    action: 'workflow_dispatch'
  selection_inputs:
    inputs|contains:
      - ';'
      - '&&'
      - '||'
      - '$(('
      - '`'
      - '>>'
  condition: selection_event and selection_inputs
falsepositives:
  - Legitimate version strings containing rare characters (unlikely)
level: high
tags:
  - attack.t1059
  - attack.t1195
  - cve.2026.91936

YARA Rule

rule CVE_2026_91936_Flowise_Workflow_Command_Injection
{
    meta:
        description = "Detects shell metacharacter injection patterns targeting Flowise Docker build workflow_dispatch inputs (CVE-2026-91936)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91936"
        date = "2026-01-01"
        severity = "high"

    strings:
        $wfd = "workflow_dispatch" ascii nocase
        $t1  = "tag_version" ascii nocase
        $t2  = "node_version" ascii nocase
        $m1  = "$(curl" ascii
        $m2  = "$(wget" ascii
        $m3  = "; curl" ascii
        $m4  = "&& curl" ascii
        $m5  = "`curl" ascii
        $m6  = "aws_access_key_id" ascii nocase
        $m7  = "docker login" ascii nocase

    condition:
        $wfd and ($t1 or $t2) and 2 of ($m*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91936 Flowise workflow_dispatch Command Injection Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/dispatches"; http.header; content:"Authorization"; content:"tag_version"; nocase; pcre:"/(tag_version|node_version)[^\r\n]*([;&|`]|\\$\\(|\\$\\{)/i"; reference:cve,2026-91936; classtype:attempted-admin; sid:202691936; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [authentication where event.action == "workflow_dispatch" and
     process.args : ("*tag_version*", "*node_version*")]
  [process where event.type == "start" and
     process.name : ("sh", "bash") and
     process.args : ("*aws*", "*docker*", "*curl*", "*wget*")]

Splunk SPL Query

index=ci_cd sourcetype=github:audit action=workflow_dispatch
| eval suspicious=mvcount(mvfilter(match(inputs, "(;|&&|\|\||\$\()")))
| where suspicious > 0
| stats count min(_time) as first_seen max(_time) as last_seen values(inputs) as injected_inputs by actor, repo, workflow
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="github_actions,flowise,cve_2026_91936">
  <rule id="100936" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">workflow_dispatch</field>
    <field name="inputs" type="pcre2">(?i)(tag_version|node_version).*(;|&amp;&amp;|\|\||\$\(|`)</field>
    <description>CVE-2026-91936: Potential command injection in Flowise Docker build workflow_dispatch input</description>
    <mitre>
      <id>T1059</id>
      <id>T1195</id>
    </mitre>
    <group>ci_cd_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate mitigations (pre-patch, if upgrade is delayed):

   • Restrict workflow_dispatch triggering to a minimal set of trusted maintainers; review repository write permissions.
   • Refactor the workflow so workflow_dispatch inputs are passed through intermediate env: variables and referenced as ${{ env.VAR }} (quoted) rather than interpolated directly into run: blocks — GitHub's documented mitigation for script injection.
   • Rotate AWS credentials and Docker Hub tokens used by the build workflow to reduce exposure from any prior compromise; scope them to least privilege.
   • Enable environment protection rules and required reviewers on the Docker build workflow.

2. Patch/upgrade steps:

   • Upgrade Flowise to 3.1.4 (per OSV). Because patch confidence is only 2/4, verify against the vendor's official release notes and the repository commit history before relying on the fix; the CVE record lists the vendor/product as unknown and affected-version data as empty, so confirm applicability to your deployment.

3. Long-term hardening:

   • Adopt a policy of never interpolating untrusted github.event context data directly into run: blocks; enforce via workflow linting (e.g., actionlint) in CI.
   • Apply least-privilege to CI runner identities and use short-lived, OIDC-based credentials instead of long-lived AWS keys and registry tokens.
   • Monitor workflow_dispatch audit events for metacharacter patterns and alert on shell invocations that reference cloud/registry tooling.

References

1. NVD — CVE-2026-91936: https://nvd.nist.gov/vuln/detail/CVE-2026-91936
2. OSV — Flowise advisory (single-source patch claim, 3.1.4): https://osv.dev/vulnerability/CVE-2026-91936
3. GitHub Security Lab — Preventing script injection in GitHub Actions workflows: https://securitylab.github.com/research/github-actions-untrusted-input/
4. CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
5. CISA KEV Catalog — not applicable (CVE-2026-91936 is NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild evidence: None. No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing were identified. EPSS 0.00348 (28.3rd percentile) indicates low predicted exploitation activity. All detection content above is inferred from the vulnerability class (CWE-78 in GitHub Actions workflow_dispatch interpolation); specific repository, workflow, and file paths were not provided in the source data and are therefore not asserted.