CVE-2025-8943 in the critical feed json
Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers
published last yr. modified 4mo ago also GHSA-2vv2-3x8x-4gv7 , EUVD-2025-24801
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 75.3%
- EPSS 75.3% chance of exploitation in 30 days, percentile 99.5%
- public exploits
- 1
- Metasploit, plus a Nuclei check
Summary
The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.
Patch / fix
- flowiseai flowise 3.0.1
Is CVE-2025-8943 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- First public exploit (Metasploit exploit/multi/http/flowise_custommcp_rce)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- last yr.
Exploit prediction
75.30% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/multi/http/flowise_custommcp_rce Flowise Custom MCP Remote Code Execution metasploit exploit, excellent rank, 2025-08-14
- Nuclei template Flowise < 3.0.1 - Remote Command Execution nuclei detection template
- research.jfrog.com https://research.jfrog.com/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | flowise | <=3.0.5 |
no fix listed |
Classification
References
-
research.jfrog.com
/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578/
third-party-advisory, exploit
-
nvd.nist.gov
/vuln/detail/CVE-2025-8943
advisory
-
github.com
/FlowiseAI/Flowise
package
-
research.jfrog.com
/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578
web
Sources
- CVE List CVE-2025-8943
- GitHub Advisory GHSA-2vv2-3x8x-4gv7
- NVD CVE-2025-8943
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.