On 15 September 2026, NVD published CVE-2026-91931 and CVE-2026-91932 for Flowise, the low-code builder for LLM apps and agents. Both are remote code execution bugs in the Custom MCP node, where an authenticated user can configure an MCP server that Flowise launches over stdio. Both are fixed in Flowise 3.1.4, published to npm on 29 July, which is also the last release: the Flowise team archived the repository on 13 August and declared end of life on 31 August.
What's affected
CVE-2026-91931 (GHSA-vcwp-f9rq-3887, CVSS 4.0 9.0). The Custom MCP validator allowed npx as a command and blocked only a few flags. As the advisory puts it, "allowing npx still allows arbitrary npm package binaries to execute." Package names, sources and the binaries they provide were not restricted. The process spawned before Flowise checked whether it was a real MCP server, so the code ran even when the request failed. Credited to DavidCarliez.
CVE-2026-91932 (GHSA-x7x8-95gh-42xm, CVSS 4.0 9.0). validateMCPServerConfig() checked the command, arguments and environment but ignored cwd. An attacker could pass a harmless-looking filename in the arguments and point the working directory at malicious code. This one needs the attacker to get files into that directory first, so attack complexity is high.
Affected: flowise and flowise-components 3.1.3 and earlier. Fixed: 3.1.4.
Both require an authenticated Flowise session with access to Custom MCP. Code runs as the Flowise process inside its container.
Also patched in the final releases. On 7 October, GitHub's Advisory Database added CVE-2026-73487 (GHSA-w7x8-q2gp-5cgg) after review. The CSV Agent and Airtable Agent nodes screened LLM-generated Python with a regex blocklist that missed URL-accepting pandas functions such as read_json, plus importlib and chr(). Through prompt injection on the prediction endpoint, which the advisory says is reachable without an API key by default, an attacker could exfiltrate the loaded dataset or make SSRF requests. Fixed in 3.1.3, credited to Peyton Kennedy of Endor Labs.
How to check if you're exposed
Find Flowise installs and their versions:
npm ls -g flowise 2>/dev/null
npm ls flowise flowise-components 2>/dev/null
docker ps --format '{{.Image}}' | grep -i flowise
Anything below 3.1.4 is vulnerable to both MCP CVEs. Image tags like latest hide the version, so check the image digest or run the npm command inside the container.
Then check who can log in and who can use Custom MCP. Both CVEs need an account, so the question is how many accounts exist and whether sign-up is open.
If a package.json pins Flowise, the free scan at gold.safeguard.sh/scan will flag the version without uploading the file.
What to do now
- Upgrade to 3.1.4. It's the final release and the only one with both MCP fixes.
- Plan a migration or a maintained fork. The "Future of Flowise" announcement says feature development stopped, pull requests are no longer reviewed, and official core team presence ended on 31 August. It doesn't mention any plan for future security fixes.
- Disable Custom MCP stdio for anyone you don't fully trust. The CVE-2026-91931 advisory recommends allowing only administrator-installed MCP binaries referenced by absolute path, and removing
npxfrom the allowlist. - Contain the process. Run Flowise with no cloud credentials in its environment, a read-only filesystem where possible, restricted network egress and no Docker socket. The advisory notes the impact grows with broad mounts and elevated privileges.
- Log every stdio process launch and alert on unexpected
npxpackage names. - Put an API key on prediction endpoints for chatflows that use the CSV or Airtable agent, and keep those flows off the public internet.
Why it matters
npx some-package is the most common way MCP servers get launched, and it means "download and run whatever this name resolves to today." When an app lets users type that string, it lets users pick code to run on the server. A flag blocklist doesn't change that.
The bigger story is maintenance. Flowise is widely deployed, and its final release came out just before the team stepped away. Two critical CVEs were published after end of life, and future issues may have no upstream fix at all. AI tooling has moved fast, and some of it will stop just as fast. Track the support status of the platforms holding your provider keys, not just their CVEs.
Try it yourself
Pick an MCP config file in your organization and list every npx or uvx command it launches. For each one, check who publishes the package and whether the version is pinned. Then see how malicious and typosquatted packages show up in a dependency review.
Click through it at your own pace, or open it full screen.
Quick check
Is Flowise still maintained?
The Flowise team announced a wind-down, archived the GitHub repository on 13 August 2026 and set end of life for 31 August 2026. The announcement points users to forking the Apache 2.0 code.
Why wasn't blocking flags like -c enough for CVE-2026-91931?
Because npx itself runs package binaries. Any npm package an attacker publishes can contain the code, so the package name is the payload.
Does CVE-2026-73487 need a Flowise account?
No. The advisory says the prediction endpoint is reachable without an API key by default, and the attack works through prompt injection in the question sent to a CSV or Airtable agent flow.
Sources
- GHSA-vcwp-f9rq-3887: Flowise Custom MCP npx command execution
- GHSA-x7x8-95gh-42xm: Flowise MCP server config cwd validation bypass
- GHSA-w7x8-q2gp-5cgg: Flowise prompt injection to RCE and SSRF via CSV/Airtable agent
- NVD: CVE-2026-91931
- NVD: CVE-2026-91932
- Flowise discussion #6727: Future of Flowise
- npm: flowise
