CVE-2026-91936 describes an OS command injection vulnerability in FlowiseAI Flowise versions prior to 3.1.4. The vulnerability arises from improper neutralization of special elements in workflow_dispatch inputs such as tag_version and node_version, which are directly interpolated into shell run blocks during Docker image build workflows. This allows an attacker with repository write access to inject shell metacharacters and execute arbitrary commands. The impact includes potential theft of sensitive credentials like AWS credentials and Docker Hub tokens. The vulnerability has a CVSS 3.1 score of 6.8 (medium severity) with network attack vector, low attack complexity, high privileges required, no user interaction, and a scope change with no confidentiality impact but high integrity impact and no availability impact. A patch is available and should be applied.

An attacker with repository write access can exploit this vulnerability to execute arbitrary OS commands within the Docker image build process. This can lead to theft of sensitive credentials such as AWS credentials and Docker Hub tokens, compromising the integrity of the affected environment. There is no reported impact on confidentiality or availability beyond the credential theft risk.

A patch is available for FlowiseAI Flowise that fixes this vulnerability in version 3.1.4. Users should upgrade to version 3.1.4 or later to remediate this issue. Since this is a cloud service, the vendor manages remediation for the cloud-hosted service; users should verify with the vendor advisory for confirmation. Until patched, restrict repository write access to trusted users only to reduce risk.