A validation bypass in Flowise's MCP server configuration allows authenticated attackers to achieve arbitrary code execution by exploiting an unvalidated cwd parameter that bypasses existing security controls.
The validateMCPServerConfig() function in packages/components/nodes/tools/MCP/core.ts validates the command , args , and env parameters but completely ignores the cwd parameter. This parameter is later passed directly to StdioClientTransport , allowing attackers to bypass path validation by using clean filenames in args while controlling the working directory via cwd .
Attacker uses clean filename in args array: ["script.js"] (passes validation)
Attacker sets cwd to point to directory with malicious files: "/upload/path" (unvalidated)
Validation succeeds because filename contains no path traversal
Process spawns from attacker-controlled directory, executing malicious code
Authenticated remote code execution
Bypass of existing security controls
Affects all current Flowise installations
All current versions of Flowise (tested on latest Docker image)
Specifically affects MCP server configuration functionality
Vulnerable Code Location
File : packages/components/nodes/tools/MCP/core.ts Function : validateMCPServerConfig() (lines 364-392)
Add cwd validation to validateMCPServerConfig() :
Another option is to block it completely.
Relationship to Existing CVEs
This appears to be separate from CVE-2026-40933 , which addressed command flag validation. This vulnerability involves a different parameter ( cwd vs args ) and requires a separate fix.
CWE-20 : Improper Input Validation
CWE-78 : OS Command Injection
Request CVE Assignment
☑️ Yes, please request a CVE ID for this vulnerability
Coordinated Disclosure
☑️ This is being reported privately first to allow for coordinated disclosure
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
