CVE-2026-91932CWE-20

CVE-2026-91932

High · published September 15, 2026

CVSS v3.1
8.5
EPSS
1%
Percentile
53.9
In the wild
Unconfirmed
What it is

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working directory to execute malicious code.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
9.0 · CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00734 · 53.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-09-15T20:17Z
References (3)
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x7x8-95gh-42xm · [email protected]https://www.vulncheck.com/advisories/flowise-before-3.1.4-remote-code-execution-via-cwd-parameter · [email protected]https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x7x8-95gh-42xm · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 1%
    epss
  • 15 SEP 15:17Z
    Flowise before 3.1.4 Remote Code Execution via cwd Parameter
    cvelistv5