CVE-2026-91936

Flowise before 3.1.4 Script Injection via Docker Workflows

Published: Sep 15, 2026Updated: Sep 17, 2026 Sources: CVE List NVDCWE-78

6.8MEDIUM

Description

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tag_version and node_version to execute arbitrary commands and steal AWS credentials and Docker Hub tokens.

In plain language

AI Low urgency

Flowise versions before 3.1.4 have a flaw that lets someone already allowed to change its project files run unwanted commands, so most small businesses should schedule an update rather than treat this as an emergency.

Executive summary

CWE-78 command injection in Flowise Docker build workflows allows repository write-access users to inject shell commands through workflow-dispatch inputs interpolated into run blocks.

If affected, business impact

Build-system takeoverCloud credential theftDocker account token theftUnauthorized image changes

What to do now

Check whether you use Flowise and whether its version is earlier than 3.1.4.
Upgrade Flowise to version 3.1.4 or later.
Review who can edit the Flowise project and remove unnecessary write access.
If untrusted people had write access, replace cloud and container-service access keys used by builds.

Usually a quick update

What is it

This issue affects the automated process used to build Flowise container images. It is like allowing someone with access to the workshop instructions to add their own errands for the workshop staff: they could make the build system run unwanted tasks and take keys stored there.

Who is affected

This matters to you if you run Flowise and use its Docker image build workflows. It is only a risk if an attacker already has permission to write to the related project repository.

How urgent is it

No known public exploitation or public attack code has been recorded, and it is not listed in CISA's catalog of actively exploited vulnerabilities. Treat this as routine maintenance: update on your normal near-term change schedule and tighten repository write access.

What to do — in detail

Confirm the deployed Flowise version and inspect repositories that use Flowise Docker image build workflows. Upgrade Flowise to 3.1.4 or later; the available findings provide no branch-specific alternative fixed versions or upgrade-breaking-change notes.

If patching is delayed, restrict repository write permission to trusted maintainers and do not run Docker build workflows from untrusted changes. Review recent workflow changes and build activity for unexpected commands; if untrusted write access existed, rotate AWS credentials and Docker Hub tokens available to builds. CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV.

Technical context

CVE-2026-91936 is rated CVSS 6.8 (Medium): CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N. The weakness is CWE-78 command injection: Docker workflow-dispatch inputs, including tag_version and node_version, are directly interpolated into shell run blocks, allowing a repository write-access attacker to execute arbitrary commands. No public exploit code is on record; CISA KEV does not list the CVE. EPSS is 0.3% (29th percentile) with a flat trend, indicating low predicted likelihood rather than confirmed exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:HPrivileges Required

High

UI:NUser Interaction

None

Scope

S:CScope

Changed

Impact

C:NConfidentiality

None

I:HIntegrity

High

A:NAvailability

None

Open in CVSS calculator →

Weaknesses

CWE-78

Affected Products

FlowiseAI

oss-projectaka flowise-components, embed, flowise

FlowiseOn-premWeb App

AI / ML / ai-agent-tooling

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.

Is your org exposed to CVE-2026-91936?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique

Execution

View detailed technique mapping

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jrcq-qjw5-xx5q

github.com

https://www.vulncheck.com/advisories/flowise-before-3.1.4-script-injection-via-docker-workflows

vulncheck.com

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-91936 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows