# Flowise Custom MCP STDIO Command Injection (CVE-2026-40933)

- **Severity:** Critical
- **Signature ID:** `2cb560c1-1ad2-430a-9261-14ae8f06e0b5`
- **CVEs:** CVE-2025-59528, CVE-2026-40933
- **MITRE ATLAS:** AML.T0040 (AI Model Inference API Access), AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI04 (Memory and Context Poisoning), ASI05 (Cascading Failures in Multi-Agent Systems), LLM01 (Prompt Injection), LLM05 (Improper Output Handling)

## Summary

Flowise, a platform for building AI agent workflows, has a flaw in how it lets agents call external tools over MCP (Model Context Protocol) using STDIO commands. An authenticated attacker can smuggle arbitrary code past Flowise's safety checks and get it executed directly on the server hosting Flowise.

## How the attack works

Flowise's Custom MCP node checks commands against an allow-list (e.g. npx, node) to block unsafe invocations. An attacker configures the node to run an allowed command but adds an inline-execution flag, such as `npx -c '<javascript>'` or `node -e '<javascript>'`. The allow-list check only looks at the command name, not the flags, so it passes validation while the flag causes the supplied JavaScript to execute immediately. This gives the attacker arbitrary command execution on the machine running Flowise, using whatever privileges that process has.

## Why it matters

An attacker with a valid Flowise account can take over the server hosting Flowise, potentially accessing other connected systems, credentials, and data reachable from that host.

## What you can do

- Upgrade Flowise past v3.1.0, where this bypass is fixed.
- Until patched, review and restrict who can create or edit Custom MCP nodes, since this requires an authenticated user.
- Audit existing Custom MCP node configurations for npx/node commands using -c or -e flags with inline code.
- Run Flowise with the least privilege possible so a compromised process has limited reach into other systems.

## Known benign look-alikes

- Legitimate Flowise documentation describing the Custom MCP node interface for educational purposes.
- Security tooling that scans MCP configurations for the CVE-2026-40933 payload pattern.
- Approved Custom MCP nodes that legitimately invoke npx with a package name only (no -c flag), e.g. `npx @modelcontextprotocol/server-filesystem`.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00415
- https://nvd.nist.gov/vuln/detail/CVE-2026-40933

---
Source: https://www.netzilo.com/threats/atr-flowise-custom-mcp-stdio-command-injection-cve-2026-40933