What is GHSA-63x5-9mcr-7447?

GHSA-63x5-9mcr-7447 is a security advisory published by GitHub Security Advisories with Critical severity. Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration...

Which CVE IDs does GHSA-63x5-9mcr-7447 cover?

GHSA-63x5-9mcr-7447 covers the following CVE IDs: CVE-2026-91932. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-63x5-9mcr-7447?

GHSA-63x5-9mcr-7447 has a CVSS v3 base score of 8.5, published by GitHub Security Advisories.

GHSA-63x5-9mcr-7447CriticalCVSS 8.5

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration...

Vendor

GitHub Security Advisories

Published

September 15, 2026

Last Modified

September 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-91932 →

📋 Description

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working directory to execute malicious code.

🔗 References (4)

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x7x8-95gh-42xm
https://nvd.nist.gov/vuln/detail/CVE-2026-91932
https://www.vulncheck.com/advisories/flowise-before-3.1.4-remote-code-execution-via-cwd-parameter
https://github.com/advisories/GHSA-63x5-9mcr-7447