What is GHSA-q5vh-j6x8-9f53?

GHSA-q5vh-j6x8-9f53 is a security advisory published by GitHub Security Advisories with Critical severity. Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that...

Which CVE IDs does GHSA-q5vh-j6x8-9f53 cover?

GHSA-q5vh-j6x8-9f53 covers the following CVE IDs: CVE-2026-91931. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q5vh-j6x8-9f53?

GHSA-q5vh-j6x8-9f53 has a CVSS v3 base score of 8.5, published by GitHub Security Advisories.

GHSA-q5vh-j6x8-9f53CriticalCVSS 8.5

Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that...

Vendor

GitHub Security Advisories

Published

September 15, 2026

Last Modified

September 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-91931 →

📋 Description

Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code on the Flowise server.

🔗 References (4)

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-vcwp-f9rq-3887
https://nvd.nist.gov/vuln/detail/CVE-2026-91931
https://www.vulncheck.com/advisories/flowise-before-3.1.4-remote-code-execution-via-custom-mcp-npx
https://github.com/advisories/GHSA-q5vh-j6x8-9f53