{"id":"CVE-2026-41268","revision":"8b220655b3b54b78a296dc0c5c9521b5","records":[{"revision":"8b220655b3b54b78a296dc0c5c9521b5","observedAt":"2026-10-25T09:17:30.114+00:00","statement":{"source":"nvd","id":"CVE-2026-41268","aliases":[],"title":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter o…","description":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override bypass using the FILE-STORAGE:: keyword combined with a NODE_OPTIONS environment variable injection. This allows for the execution of arbitrary system commands with root privileges within the containerized Flowise instance, requiring only a single HTTP request and no authentication or knowledge of the instance. This vulnerability is fixed in 3.1.0.","state":0,"publishedAt":"2026-04-23T20:16:15.3+00:00","modifiedAt":"2026-06-17T10:46:24.753+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"},{"system":"CVSS 3.0 · security-advisories@github.com · Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","score":7.7,"severity":"HIGH"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cvrr-qhgw-2mm6"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41268","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-20"],"productCriteria":["cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-04-23T20:16:15.300","lastModified":"2026-06-17T10:46:24.753"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-41268","identifiers":["CVE-2026-41268"]},"retained":false,"historicalAffected":[]}],"coverage":[]}