Flowise Custom MCP STDIO Command Injection (CVE-2026-40933)
Flowise, a platform for building AI agent workflows, has a flaw in how it lets agents call external tools over MCP (Model Context Protocol) using STDIO commands. An authenticated attacker can smuggle arbitrary code past Flowise's safety checks and get it executed directly on the server hosting Flowise.
How the attack works
Flowise's Custom MCP node checks commands against an allow-list (e.g. npx, node) to block unsafe invocations. An attacker configures the node to run an allowed command but adds an inline-execution flag, such as `npx -c '<javascript>'` or `node -e '<javascript>'`. The allow-list check only looks at the command name, not the flags, so it passes validation while the flag causes the supplied JavaScript to execute immediately. This gives the attacker arbitrary command execution on the machine running Flowise, using whatever privileges that process has.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 2cb560c1-1ad2-430a-9261-14ae8f06e0b5
- Severity
- Critical
Why it matters
An attacker with a valid Flowise account can take over the server hosting Flowise, potentially accessing other connected systems, credentials, and data reachable from that host.
What you can do
- →Upgrade Flowise past v3.1.0, where this bypass is fixed.
- →Until patched, review and restrict who can create or edit Custom MCP nodes, since this requires an authenticated user.
- →Audit existing Custom MCP node configurations for npx/node commands using -c or -e flags with inline code.
- →Run Flowise with the least privilege possible so a compromised process has limited reach into other systems.
Known benign look-alikes
- Legitimate Flowise documentation describing the Custom MCP node interface for educational purposes.
- Security tooling that scans MCP configurations for the CVE-2026-40933 payload pattern.
- Approved Custom MCP nodes that legitimately invoke npx with a package name only (no -c flag), e.g. `npx @modelcontextprotocol/server-filesystem`.