9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-8943

CVE-2025-8943: Flowise OS command remote code execution

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-8943

CVE-2025-8943:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
flowise	npm	<= 3.0.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the Custom MCPs feature, which is designed to execute OS commands, can be accessed by unauthenticated users. The analysis traced the execution flow from the public-facing API endpoint to the service-layer function responsible for the command execution.

The JFrog security advisory provided a clear Proof of Concept (PoC), indicating that a POST request to the /node-load-method/customMCP endpoint with a specific JSON payload can trigger the vulnerability.
By inspecting the application's routing, packages/server/src/routes/node-load-methods/index.ts was identified as the router handling this endpoint. It maps the request to the getSingleNodeAsyncOptions function in the nodes controller.
The controller function, located in packages/server/src/controllers/nodes/index.ts, was found to be a simple pass-through, taking the request parameters and body and calling the corresponding function in the nodes service.
The service function, getSingleNodeAsyncOptions in packages/server/src/services/nodes/index.ts, contains the root cause of the vulnerability. It dynamically resolves a method name (loadMethod from the request body) on a component node (nodeName from the URL) and executes it.

When an attacker sends the PoC payload, the getSingleNodeAsyncOptions service function calls the listActions method on the customMCP node component, passing it the attacker-controlled mcpServerConfig which contains the OS command to be executed. The lack of authentication checks before this dangerous operation allows for unauthenticated remote code execution.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.