Input validation error in Flowise - #VU146548
Published: September 1, 2026
Vulnerability identifier: #VU146548
CSH Severity: Medium
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper input validation in validateMCPServerConfig() in packages/components/nodes/tools/MCP/core.ts when processing MCP server configuration. A remote user can supply a crafted cwd parameter to execute arbitrary code.
The issue arises because the cwd parameter is not validated before being passed to StdioClientTransport, allowing path validation checks on args to be bypassed.
Affected software
Flowise
Remediation
Install security update from vendor's website.
Flowise - update to 3.1.4