VulnSocial

CVE-2026-91931Patch

LOWCVSS 9.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code on the Flowise server.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-16: 1Patch / Workaround · 2026-09-16: 1Technical Details · 2026-09-16: 109-16
Signal classification1 categories
Patch
1100.0%
Full discourse1 post
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨High - Flowise Custom MCP Node npx Package RCE (CVE-2026-91931) Flowise's Custom MCP node mishandles the mcpServerConfig parameter, allowing authenticated attackers to supply arbitrary npx package names. The server invokes npx with attacker-controlled npm packages, resulting in remote code execution. 👉Affected: flowise / flowise-components < 3.1.4 | Upgrade to 3.1.4

    Post summary

    The text discloses CVE-2026-91931, an RCE vulnerability in Flowise's Custom MCP node caused by mishandling of the mcpServerConfig parameter, allowing authenticated remote code execution via attacker-controlled npx packages, and explicitly recommends upgrading to version 3.1.4 as the remediation.

    1000084
    305 followersView on X

Explore more

Back to dashboard