GHSA-cvrr-qhgw-2mm6

### Summary Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override bypass using the `FILE-STORAGE::` keyword combined with a `NODE_OPTIONS` environment variable injection. This allows for the execution of arbitrary system commands with root privileges within the containerized Flowise instance, requiring only a single HTTP request and no authentication or knowledge of the instance. ### Details The vulnerability is in a validation check within the `replaceInputsWithConfig` function within `packages/server/src/utils/index.ts`. The check for `FILE-STORAGE::` was intended to handle file-type inputs but has three issues: 1. Uses .includes() instead of .startsWith(): The check passes if FILE-STORAGE:: appears ANYWHERE in the string, not just at the beginning. A remote user can embed it in a comment: /* FILE-STORAGE:: */ { custom config } 2. No parameter type validation: The check doesn't verify that the parameter is actually a file-type input. It applies to ANY parameter name, including mcpServerConfig. 3. Complete bypass, not partial: When the check passes, it skips the isParameterEnabled() call entirely, allowing modification of parameters that administrators never authorized. **Vulnerable Code (`FILE-STORAGE::` bypass):** ```typescript // packages/server/src/utils/index.ts, line 1192-1198 // Skip if it is an override "files" input, such as pdfFile, txtFile, etc if (typeof overrideConfig[config] === 'string' && overrideConfig[config].includes('FILE-STORAGE::')) { // pass <-- BYPASSES ALL VALIDATION } else if (!isParameterEnabled(flowNodeData.label, config)) { // Only proceed if the parameter is enabled continue } ``` This bypass allows an attacker to override the `mcpServerConfig` and inject a malicious `NODE_OPTIONS` value. The `Custom MCP` node's environment variable blocklist does not include `NODE_OPTIONS`, enabling an attacker to use the `--experimental-loade