The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| flowise(npm) | 0 | N/A | N/A |
CVSS Metrics
