Flowise’s Custom MCP node took an npm package name from the user and ran it

VulnCheck filed two records against Flowise on 15 September, each at 9.0 out of 10 on CVSS 4.0.

Both concern the Custom MCP node, which lets a flow start its own MCP server, and both score 8.5 out of 10 on the older CVSS 3.1 scale. CVE-2026-91931 says the node “allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter”, so the package that runs is whichever one the attacker publishes. CVE-2026-91932 says the path validation on that config can be bypassed “using clean filenames in the args array while controlling the working directory” through an unvalidated cwd parameter, which is a second door into the same room.

Both need an authenticated user, which VulnCheck’s scoring reflects and which is why neither is a 10. On a shared Flowise instance an authenticated user is anyone who can build a flow, and a flow is the product.

The fix is 3.1.4. The node exists so a flow can start its own MCP server, and a server is a program, so the permission to add one was always the permission to run one.