Critical Flowise RCE Flaws Let Attackers Execute Code on AI Workflow Servers

Key Takeaways

• Six critical remote code execution (RCE) vulnerabilities have been discovered in Flowise, an open-source platform for building AI agents and workflows.
• These flaws could enable authenticated attackers to execute arbitrary commands on the underlying server, compromising sensitive data and connected systems.
• The vulnerabilities affect Flowise versions 3.1.1 and 3.1.2, stemming from incomplete patches for previously identified security issues.
• Flowise has released updates to address these flaws, and administrators are urged to upgrade immediately.

A new report has revealed six severe remote code execution (RCE) vulnerabilities in Flowise, the popular open-source tool for developing AI agents and automated workflows. These security weaknesses could allow attackers with authenticated access to execute arbitrary commands on the server hosting Flowise, potentially leading to data breaches, credential theft, and compromise of interconnected systems.

The identified flaws exploit various Flowise components, including its CSV processing module, custom JavaScript functions, Multi-Chain Protocol (MCP) configurations, database nodes, and record management features. This discovery heightens existing concerns about the security of AI workflow servers, which have previously been targeted due to injection vulnerabilities.

Cybersecurity firm Elttam uncovered these issues during an audit of Flowise versions 3.1.1 and 3.1.2. Elttam said in a report that several prior security fixes implemented by Flowise were inadequate, allowing researchers to devise new bypasses. Given Flowise’s role in integrating language models with business applications, databases, and external services, a successful exploit could grant an attacker a significant foothold on the workflow host and access to all resources available to that server.

Detailed Analysis of Flowise RCE Flaws

CSV Agent Vulnerability

One critical vulnerability resided within Flowise’s CSVAgent feature, which enables users to input custom Python pandas code for processing uploaded CSV files. Despite Flowise employing a denylist to block hazardous Python functions, Elttam researchers found methods to manipulate pandas functionality, allowing command execution beyond the scope of data processing. An initial patch attempted to mitigate this by blocking unsafe deserialization and enforcing input to start with read_csv. However, Elttam circumvented these restrictions with a specially crafted expression that still leveraged pandas to access operating system functions. Subsequently, the developers chose to remove the problematic CSVAgent and AirtableAgent files due to ongoing normalization challenges.

VM2 Sandbox Escape

Another significant vulnerability involved Flowise’s utilization of the vm2 JavaScript sandbox. The sandbox, designed to isolate custom JavaScript code, inadvertently permitted access to certain external modules by default, such as moment. Researchers exploited this access to escape the confined environment and execute code directly on the host system. This finding underscores the risks associated with insecure integration settings, which can negate the intended protections of sandbox environments, mirroring concerns raised by previous critical Flowise MCP weaknesses.

Environment Variable Injection in Custom MCP

The report also detailed an environment-variable injection flaw within Custom MCP configurations. Attackers could exploit settings passed to a spawned process, including Python-related variables, to trigger arbitrary code execution. Although Flowise implemented checks for dangerous values, researchers identified a bypass that remained unpatched at the time of the report’s publication.

Additional Database-Related Issues

Three other vulnerabilities were pinpointed in the TypeORM DataSource options, the SQL Database Chain node, and the SQLite Record Manager node. Each of these components could be manipulated to write or load attacker-controlled content in an insecure manner. When combined with other Flowise functions, these flaws presented potential avenues for remote code execution.

Hardening AI Workflow Servers

These findings emphasize the necessity of treating AI workflow infrastructure with the same rigorous security measures applied to any internet-facing application. While MCP integrations expand an agent’s capabilities, they also introduce potential trust pathways that can be exploited, as demonstrated by research into MCP server execution risks.

What You Should Do

• Immediate Patching: Administrators must promptly update their Flowise installations to the latest patched version to remediate these critical RCE flaws.
• Node Review and Disablement: Conduct a thorough review of all deployed Flowise nodes. Disable or remove any components that are not strictly necessary for operational functionality.
• Restrict Exposure: Avoid directly exposing Flowise administrative interfaces and APIs to the public internet, especially in environments where users can submit code, configuration data, files, or database connection details.
• Principle of Least Privilege: Treat all MCP server settings as untrusted input. Limit the permissions granted to AI workflow processes, ensuring they operate with the minimum necessary privileges.
• Isolation and Sandboxing: Run Flowise using a non-root account and isolate it within a restricted environment (e.g., Docker containers, virtual machines). Implement stringent controls over file-system access to minimize potential damage in the event of a successful exploit.
• Proactive Monitoring: Implement robust monitoring for suspicious activities, including unexpected child processes, unusual outbound network connections, unauthorized changes to workflow configurations, and abnormal file uploads.
• Vetting External Integrations: Restrict external MCP servers to verified and trusted sources. Mandate thorough security reviews before enabling any new integrations to prevent malicious prompt attacks from creating new attack vectors.
• Adopt Allowlist Principles: Move away from denylist-based validation for dangerous inputs. Instead, prioritize allowlists, secure-by-default configurations, and the strict separation of untrusted code from the host environment as more reliable protection mechanisms for workflow platforms.

Indicators of Compromise (IoCs)

The following indicators were observed during the research and proof-of-concept demonstrations:

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.