cve-2025-8943

CRITICAL CVSS 9.8 opencve
Description

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.

Timeline
Published
2025-08-14 10:15 UTC
Last Modified
2026-06-17
CVSS Details

CVSS details not available.

Affected Products

No product information available.

Weaknesses (CWE)
CWE-306 CWE-862
CVSS metrics
Version Base Severity Vector Exploitability Impact Source
3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H mitre
3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H nvd
3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H opencve
References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "advisories": [
    {
      "id": "EUVD-2025-24801",
      "source": "euvd",
      "title": "Flowise OS command remote code execution",
      "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-24801"
    },
    {
      "id": "GHSA-2vv2-3x8x-4gv7",
      "source": "ghsa",
      "title": "Flowise OS command remote code execution",
      "url": "https://github.com/advisories/GHSA-2vv2-3x8x-4gv7"
    }
  ],
  "cve": "CVE-2025-8943",
  "enrichment": {
    "created": "2025-08-16T21:41:32.546425+00:00",
    "updated": "2025-08-16T21:41:32.546498+00:00",
    "vendors": [
      "flowiseai",
      "flowiseai$PRODUCT$flowise"
    ]
  },
  "epss": {
    "score": 0.65771
  },
  "mitre": {
    "cpes": [],
    "created": "2025-08-14T09:54:22.531000+00:00",
    "description": "The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 9.8,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2025/8xxx/CVE-2025-8943.json",
    "references": [
      "https://research.jfrog.com/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578/"
    ],
    "title": "Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers",
    "updated": "2025-08-18T16:47:58.906000+00:00",
    "vendors": [],
    "weaknesses": []
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"
    ],
    "created": "2025-08-14T10:15:29.637000+00:00",
    "description": "The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 9.8,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2025/CVE-2025-8943.json",
    "references": [
      "https://research.jfrog.com/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578/"
    ],
    "title": null,
    "updated": "2026-06-17T10:07:59.880000+00:00",
    "vendors": [
      "flowiseai",
      "flowiseai$PRODUCT$flowise"
    ],
    "weaknesses": [
      "CWE-306",
      "CWE-862"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2025-08-14T10:00:00+00:00",
        "data": [
          {
            "details": {
              "new": "The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "new": "Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "https://research.jfrog.com/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578/"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 9.8,
                  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "e9d89f2f-1194-4875-b4e7-563e371f80b6"
      },
      {
        "created": "2025-08-16T21:45:00+00:00",
        "data": [
          {
            "details": [
              "flowiseai",
              "flowiseai$PRODUCT$flowise"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "flowiseai",
                "flowiseai$PRODUCT$flowise"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "a3641f11-a87d-4468-a679-619636c5321b"
      },
      {
        "created": "2025-08-18T17:15:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "CWE-306",
                "CWE-862"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "yes",
                    "Exploitation": "poc",
                    "Technical Impact": "total"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "a73ef25b-b75c-4d6f-a34e-cef733e8008b"
      },
      {
        "created": "2025-09-23T15:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          }
        ],
        "id": "390282f5-3b69-4771-a144-43d1f777336e"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"
      ],
      "providers": [
        "nvd"
      ]
    },
    "created": {
      "data": "2025-08-14T09:54:22.531000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 9.8,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.65771
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "yes",
            "Exploitation": "poc",
            "Technical Impact": "total"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://research.jfrog.com/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578/"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": "Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers",
      "provider": "mitre"
    },
    "updated": {
      "data": "2025-09-23T15:23:05.797000+00:00",
      "provider": "nvd"
    },
    "vendors": {
      "data": [
        "flowiseai",
        "flowiseai$PRODUCT$flowise"
      ],
      "providers": [
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-306",
        "CWE-862"
      ],
      "providers": [
        "nvd",
        "vulnrichment"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2025-08-14T09:54:22.531000+00:00",
    "description": "The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "yes",
          "Exploitation": "poc",
          "Technical Impact": "total"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": "Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers",
    "updated": "2025-08-18T16:47:51.846000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2025/8xxx/CVE-2025-8943.json",
    "weaknesses": [
      "CWE-306",
      "CWE-862"
    ]
  }
}
Enrichment data
EPSS
View JSON Download
CISA KEV
View JSON Download
Nuclei templates
View JSON Download
Aggregated bundle (all enrichments)
View JSON API Download bundle
View JSON API Download JSON