Beveiligingsadvies

CVE-2026-91931

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-09-15 15:17:55

Laatst bijgewerkt 2026-09-15 15:17:55

Toegewezen door VulnCheck

CVSS-score 9.0

Status PUBLISHED

Beschrijving

Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code on the Flowise server.

← Alle CVE's bekijken Bekijk op cve.org ↗