Vulnerability · Published Aug 14, 2025 · Assigned by JFROG
CVE-2025-8943Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers
Critical 9.8
In plain English
A critical-severity missing authentication in flowise. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 75.3% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.
Official description
The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | flowise | no fix listed | GHSA-2vv2-3x8x-4gv7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| flowise | 0 – before 3.0.1 |
Weakness: CWE-306, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H