Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-2vv2-3x8x-4gv7
Advisory ID github_osv/GHSA-2vv2-3x8x-4gv7
Aliases CVE-2025-8943
Summary Flowise OS command remote code execution The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.
Status Published
Exploitability 2.0
Weighted Severity 8.8
Risk 10.0
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (2)
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-306 Missing Authentication for Critical Function
System Score Found at
cvssv3.1 9.8 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-2vv2-3x8x-4gv7/GHSA-2vv2-3x8x-4gv7.json
generic_textual CRITICAL
Reference id Reference type URL
https://github.com/FlowiseAI/Flowise
https://research.jfrog.com/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578
CVE-2025-8943 https://nvd.nist.gov/vuln/detail/CVE-2025-8943
Data source Metasploit
Description This module exploits a remote code execution vulnerability in Flowise versions >= 2.2.7-patch.1 and < 3.0.1. The vulnerability exists in the customMCP endpoint (/api/v1/node-load-method/customMCP) located in packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts and packages/components/nodes/tools/MCP/core.ts, which allows users to execute arbitrary commands via StdioClientTransport by using the 'x-request-from: internal' header. When FLOWISE_USERNAME and FLOWISE_PASSWORD are not configured, the exploit works unauthenticated. If Basic Auth is enabled, the FLOWISE_USERNAME and FLOWISE_PASSWORD options must be set to provide credentials.
Note 
Stability:
  - crash-safe
Reliability:
  - repeatable-session
SideEffects:
  - ioc-in-logs
Ransomware campaign use Unknown
Source publication date Aug. 14, 2025
Platform Linux,Unix,Windows
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/flowise_custommcp_rce.rb

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-2vv2-3x8x-4gv7/GHSA-2vv2-3x8x-4gv7.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-08-14T13:36:14Z/

Decision: Track*

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2025/8xxx/CVE-2025-8943.json

Source Advisory: vulnrichment/CVE-2025-8943

View SSVC decision tree 
[{'Exploitation': 'poc'},
 {'Automatable': 'yes'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]