MCP Launcher OS Command Injection (Flowise Custom MCP)

How the attack works

An attacker sends a request to an unauthenticated Flowise instance that reaches the Custom MCP configuration. They supply a command string that looks like a normal MCP bootstrap (npx, bunx, uvx, or pnpm dlx) but append shell operators or a second command that downloads and runs code, invokes /dev/tcp, or pipes into an interpreter. Flowise executes this as a single OS process without sandboxing, running whatever the attacker embedded alongside the legitimate-looking package install.

Netzilo detection

Why it matters

Arbitrary command execution on the server hosting Flowise, reachable by anyone on the network with no credentials, which can lead to full host compromise, data theft, or lateral movement.

What you can do

• →Upgrade Flowise to 3.0.1 or later, or restrict network access to the instance until you do.
• →Put authentication and role-based access control in front of the Custom MCP endpoint if the application itself doesn't yet enforce it.
• →Review process execution logs for npx/bunx/uvx/pnpm dlx invocations chained with shell operators, pipes to interpreters, or references to raw IP addresses or tarball URLs.
• →Run MCP server bootstraps in a sandboxed or restricted execution environment rather than directly on the host.

Known benign look-alikes

• Container or devcontainer entrypoints that wrap an MCP bootstrap in a shell, e.g. `sh -c "npx -y @modelcontextprotocol/server-filesystem /data | tee log"` — only fires if the pipe target is itself an interpreter.
• CI/CD job steps that chain an npx invocation into a shell script (`npx build-cli && bash ./scripts/publish.sh`); common in release pipelines.
• Developer one-liners typed into an agent terminal that legitimately install a community MCP server directly from a git or tarball URL instead of the npm registry.
• Security research, MCP integration testing, or red-team exercises where the operator is intentionally reproducing this exact technique.
• Documentation, README snippets or test fixtures pasted into a tool argument that then get echoed into a spawn; partially suppressed by filter_placeholder.

References

• https://attack.mitre.org/techniques/T1059/
• https://attack.mitre.org/techniques/T1059/004/
• https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
• https://modelcontextprotocol.io/docs/concepts/transports

Related threats