Flowise ships two 9.0 RCEs in its Custom MCP node, both fixed in 3.1.4

NVD·high signalXBlueskyLinkedInCopy link

CVE-2026-91931 lets an authenticated attacker execute arbitrary code by supplying npx package names in the `mcpServerConfig` parameter, invoking npx against attacker-controlled npm packages on the Flowise server. CVE-2026-91932 bypasses the same node's path validation with clean filenames in the `args` array while controlling the unvalidated `cwd` parameter. Both were published 2026-09-15 and both are fixed in Flowise 3.1.4. Related: CVE-2026-91988 (9.2) has atomic-agents-stack before 1.1.0 accepting cleartext HTTP in its MCP server-registry backend, letting a MITM inject command and argument values that `MCPClientPool` spawns locally.