CVE-2026-40933

OVERVIEW CVE-2026-40933 is a critical remote code execution vulnerability in Flowise, a drag-and-drop UI platform for building customized large language model workflows. The flaw exists in versions prior to 3.1.0 and stems from unsafe serialization of stdio commands in the MCP (Model Context Protocol) adapter. An authenticated attacker can bypass input sanitization checks by adding a malicious MCP stdio server with arbitrary commands, enabling direct command execution on the underlying operating system. SEVERITY The vulnerability carries a CVSS 3.1 score of 9.9 (Critical) with network-based attack vector, low complexity, and low privilege requirements. The attacker needs valid authentication but can achieve high-impact outcomes across the system, including complete confidentiality, integrity, and availability compromise. The vulnerability is particularly dangerous because existing input validation mechanisms, including validateCommandInjection and validateArgsForLocalFileAccess functions, can be circumvented through command argument manipulation such as combining the "npx" command with execution flags like "-c touch /tmp/pwn". EXPLOITATION STATUS There is no evidence of active exploitation in the wild at this time. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on exploitation tracking lists. However, the attack requires only authenticated access and straightforward technical knowledge, making it a moderate concern for organizations running vulnerable Flowise instances. Users should prioritize patching to version 3.1.0 or later to remediate this risk.