CVE-2025-8943

CVE-2025-8943 is a critical remote code execution (RCE) vulnerability affecting Flowise versions prior to 3.0.1. It stems from the Custom MCPs feature, which executes OS commands, combined with Flowise's minimal authentication and lack of RBAC, especially when no authentication is configured by default. This allows unauthenticated network attackers to execute arbitrary OS commands on the underlying system, leading to complete compromise. The vulnerability has a CVSS score of 9.8 (Critical) and an EPSS score indicating a high likelihood of exploitation. Exploit modules are publicly available in Metasploit and Nuclei, though there is currently no evidence of active exploitation or significant community discussion.