CVE-2026-91932 — Flowise before 3.1.4 Remote Code Execution via cwd Parameter
Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd par…
Published: 2026-09-15 · CVSS: 9.0 · CVSS 4.0
Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working directory to execute malicious code.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7