Flowise, a widely used open-source platform for building AI agents and automated workflows, has been found to contain six critical remote code execution (RCE) vulnerabilities. These flaws could allow authenticated attackers to execute arbitrary commands on the underlying server, potentially compromising sensitive data, credentials, and connected systems.
The vulnerabilities affect several components within Flowise, including CSV processing, custom JavaScript functions, Model Context Protocol (MCP) configurations, database nodes, and record-management features. Researchers at Elttam identified these issues while reviewing Flowise versions 3.1.1 and 3.1.2. They noted that previous fixes were incomplete, enabling new methods to bypass earlier security controls.
Details of the Six RCE Vulnerabilities
The first vulnerability pertains to the CSVAgent feature, which allows users to provide custom pandas code for processing uploaded CSV files. Despite Flowise implementing a denylist to block risky Python functions, researchers discovered methods to exploit pandas functionality to execute commands beyond the intended data-processing tasks. An initial patch attempted to block unsafe deserialization and required input to begin with ‘read_csv’. However, Elttam found that crafted expressions could still meet these restrictions while accessing operating-system functionality through pandas. Consequently, the developers removed the affected CSVAgent and AirtableAgent files after identifying normalization concerns.
The second flaw involves Flowise’s use of the vm2 JavaScript sandbox. The sandbox permitted certain external modules by default, including ‘moment’. Researchers leveraged this access to escape the restricted environment and execute code on the host, highlighting the risks associated with insecure integration settings that can undermine assumed protections.
A third issue was identified in the Custom MCP configurations, where environment-variable injection could occur. Attackers could manipulate settings passed to a spawned process, including Python-related variables, to trigger execution. Although Flowise introduced checks for dangerous values, researchers found a bypass that remained unpatched at the time of the report.
Three additional vulnerabilities were found in the TypeORM DataSource options, SQL Database Chain node, and SQLite Record Manager node. Each of these could be exploited to write or load attacker-controlled content in unsafe ways, potentially leading to code execution when combined with other Flowise functions.
Recommendations for Securing AI Workflow Servers
These findings underscore the importance of treating AI workflow infrastructure with the same level of security attention as any internet-facing application. MCP integrations can enhance an agent’s capabilities but may also introduce dangerous trust paths if not properly secured.
Administrators are advised to promptly update Flowise to the latest version, review all deployed nodes, and remove or disable components that are not essential. It’s crucial to avoid exposing administrative interfaces and APIs directly to the public internet, especially where workflow users can submit code, configuration data, files, or database connection details.
Organizations should consider MCP server settings as untrusted input and limit the permissions available to AI workflow processes. Running Flowise with a non-root account, isolating it in a restricted environment, and closely controlling file-system access can mitigate potential damage if a vulnerability is exploited.
Security teams should monitor for unexpected child processes, suspicious outbound connections, changes to workflow configurations, and unusual file uploads. Additionally, restricting external MCP servers to verified sources and requiring thorough review before integration can further enhance security.
As AI workflows become increasingly integral to business operations, ensuring their security is paramount. Organizations must adopt a proactive approach to identify and mitigate vulnerabilities, safeguarding their systems and data from potential exploitation.
