Flowise versions prior to 3.1.0 contain a critical unauthenticated remote command execution vulnerability that allows attackers to gain full system control.

This vulnerability is an improper input validation flaw (CWE-20) that allows an unauthenticated attacker to inject arbitrary commands through a parameter override bypass using the FILE-STORAGE:: keyword combined with a NODE_OPTIONS environment variable injection.

The ability for an unauthenticated attacker to achieve remote command execution with root privileges poses a catastrophic risk to the integrity, confidentiality, and availability of the host system. Given the CVSS score of 7.7, this flaw represents a high-severity threat that could lead to full system compromise, data exfiltration, or the deployment of persistent malware within the containerized environment.

Immediate Action: Update Flowise and Flowise-components to version 3.1.0 or later immediately to apply the necessary input validation patches.

Proactive Monitoring: Review web access logs for suspicious HTTP requests containing the string "FILE-STORAGE::" or references to "NODE_OPTIONS" and monitor container environments for unauthorized child processes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block incoming requests containing unexpected parameter overrides or suspicious environment variable injection patterns.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with the ease of exploitation, necessitates an immediate update to version 3.1.0 across all instances. Organizations should prioritize patching this software above lower-risk updates to prevent potential full-system compromise by unauthenticated actors.