Input validation error in Flowise - CVE-2026-91932
Published: September 1, 2026 / Updated: September 16, 2026
Vulnerability identifier: #VU146548
CSH Severity: Medium
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-91932
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper input validation in validateMCPServerConfig() in packages/components/nodes/tools/MCP/core.ts when processing MCP server configuration. A remote user can supply a crafted cwd parameter to execute arbitrary code.
The issue arises because the cwd parameter is not validated before being passed to StdioClientTransport, allowing path validation checks on args to be bypassed.
Affected software
Flowise
How to mitigate CVE-2026-91932
Install security update from vendor's website.
Flowise - update to 3.1.4