Flowise Custom MCP STDIO Command Injection (CVE-2026-40933) - ATR-2026-00415 (ef7a699b-d454-5582-a918-ed66c94f376b)
Detects exploitation of CVE-2026-40933 (CVSS 9.9), authenticated RCE in Flowise Custom MCP node before v3.1.0. Flowise's MCP adapter performs validateCommandInjection / validateArgsForLocalFileAccess checks but attackers bypass them by combining allow-listed commands (e.g. npx, node) with code-execution flags such as npx -c '<inline JS>' or node -e '<inline JS>'. Result: arbitrary OS command execution on the Flowise host. Disclosed 2026-04-15 (OX Security MCP-by-design batch). Distinct from CVE-2025-59528 (template injection in System Message); this rule covers the STDIO command-list bypass surface.