AI workflow servers, particularly those running Flowise, are currently at risk due to six newly identified remote code execution (RCE) vulnerabilities. These flaws can potentially allow authenticated users to execute arbitrary commands on the server, endangering sensitive data and connected systems.
Understanding the Vulnerabilities
The RCE threats impact several components of Flowise, such as CSV processing tools, custom JavaScript functions, and database nodes. The vulnerabilities were brought to light by researchers from Elttam, who examined Flowise versions 3.1.1 and 3.1.2. Despite previous patches, the researchers uncovered that certain security measures were inadequate, enabling them to navigate around existing protections.
These vulnerabilities are particularly concerning because Flowise connects language models to various business tools, databases, and external services. A successful breach could allow attackers to gain control over the workflow server and access its resources.
Detailed Examination of the Flaws
One significant flaw was found in the CSVAgent feature, which lets users input custom pandas code to process CSV files. Despite the implementation of a denylist to block risky Python functions, the researchers discovered methods to exploit pandas functionalities, enabling command execution beyond data processing.
Another vulnerability involved the vm2 JavaScript sandbox, which by default permitted certain external modules like ‘moment.’ This access allowed researchers to escape the restricted environment and execute code on the host server. Additionally, a bypass for environment-variable injections in Custom MCP configurations was found, which remained unpatched at the time of reporting.
Security Recommendations and Outlook
To mitigate these risks, administrators are advised to promptly update Flowise, review all deployed nodes, and remove unnecessary components. It’s crucial to avoid exposing administrative interfaces and APIs to the public internet, especially where user-submitted code and configurations are involved. Treating MCP server settings as untrusted input and limiting permissions for AI workflow processes can further enhance security.
Security teams should monitor for unusual activities, such as unexpected processes or outbound connections, and restrict external MCP servers to verified sources. Elttam recommends stronger isolation models over reliance on denylist-based validation and emphasizes the importance of allowlists, secure defaults, and separation of untrusted code.
By implementing these security measures, organizations can better protect their AI workflow infrastructure from potential threats and ensure a more resilient defense against cyber attacks.
