CVE-2025-8943
Flowise OS command remote code execution
9.8
CRITICAL
CVSS 3.1
EPSS 70.9%
描述
The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.
如何修補 CVE-2025-8943
目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。
- —未列出修補版本
CVE-2025-8943 正在被利用嗎?
可能 — EPSS 為 70.9%,屬於高被利用機率區間,建議優先修補。
受影響套件(1)
- from 0, <= 3.0.5
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |