Command Injection in Flowise Custom MCP stdio Configuration
CVE-2026-40933 is a command injection / server-side remote code execution vulnerability in Flowise prior to version 3.1.0, affecting the Custom MCP functionality that uses the Model Context Protocol (MCP) stdio transport. The flaw is caused by unsafe serialization and execution of user-controlled stdio command configurations in the MCP adapter. In the vulnerable design, Flowise allows users to define an MCP stdio server from the canvas Custom MCP configuration, and the configured command is launched as a child process on the Flowise host. Although Flowise implemented validation and allowlisting checks such as validateCommandInjection, validateArgsForLocalFileAccess, and restrictions around specific commands and flags, the underlying execution primitive remained user-controlled. Allowed commands such as npm or npx could still be combined with arguments or equivalent mechanisms that result in arbitrary OS command execution. The provided context also states that a crafted chatflow import can trigger backend MCP tool enumeration during rendering, causing code execution on import alone, before any explicit save or run action. The issue affects self-hosted Flowise deployments where stdio MCP is enabled and was fixed in Flowise 3.1.0.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical command injection / remote code execution vulnerability in Flowise's MCP adapter caused by unsafe serialization of stdio commands, enabling authenticated attackers to execute arbitrary OS commands.
A one-click remote code execution vulnerability in Flowise's Custom MCP tool handling that allows attacker-controlled stdio MCP configurations embedded in shared chatflows to execute arbitrary server-side code during import.
A vulnerability in Flowise stemming from unsafe MCP STDIO configuration that can enable command execution on the server.
A high-severity remote command execution vulnerability in Flowise caused by bypassing command allowlist protections through crafted arguments in MCP task configuration.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.