by Kastro
Paper/Archive/CVE-2025-8943

CVE-2025-8943

JFROG — Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers

EPSS 75%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.5.995 × 2019.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.

Affected

ProductAffectedFixed inSource
flowise< 3.0.13.0.1CNA

Scores by source

JFROG (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupresearch.jfrog.com/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578