How the attack works
Flowise's Custom MCP node checks commands against an allow-list (e.g. npx, node) to block unsafe invocations. An attacker configures the node to run an allowed command but adds an inline-execution flag, such as `npx -c '<javascript>'` or `node -e '<javascript>'`. The allow-list check only looks at the command name, not the flags, so it passes validation while the flag causes the supplied JavaScript to execute immediately. This gives the attacker arbitrary command execution on the machine running Flowise, using whatever privileges that process has.
Why it matters
An attacker with a valid Flowise account can take over the server hosting Flowise, potentially accessing other connected systems, credentials, and data reachable from that host.
What you can do
- Upgrade Flowise past v3.1.0, where this bypass is fixed.
- Until patched, review and restrict who can create or edit Custom MCP nodes, since this requires an authenticated user.
- Audit existing Custom MCP node configurations for npx/node commands using -c or -e flags with inline code.
- Run Flowise with the least privilege possible so a compromised process has limited reach into other systems.
Known benign look-alikes
- Legitimate Flowise documentation describing the Custom MCP node interface for educational purposes.
- Security tooling that scans MCP configurations for the CVE-2026-40933 payload pattern.
- Approved Custom MCP nodes that legitimately invoke npx with a package name only (no -c flag), e.g. `npx @modelcontextprotocol/server-filesystem`.