FlowiseAI/Flowise · error · Error

Argument contains potentially dangerous characters: "${arg}"

Error message

Argument contains potentially dangerous characters: "${arg}"

What it means

Thrown by validateCommandInjection when any string arg matches one of the dangerousPatterns regexes: shell metacharacters [;&|`$(){}[\]<>], command chaining (&&, ||, ;;), redirections (>>, <<, >), backticks/$(, or process substitution <( >(. The guard rejects args before they reach StdioClientTransport to prevent shell injection through MCP command arguments.

Source

Thrown at packages/components/nodes/tools/MCP/core.ts:281

    const dangerousPatterns = [
        // Shell metacharacters
        /[;&|`$(){}[\]<>]/,
        // Command chaining
        /&&|\|\||;;/,
        // Redirections
        />>|<<|>/,
        // Backticks and command substitution
        /`|\$\(/,
        // Process substitution
        /<\(|>\(/
    ]

    for (const arg of args) {
        if (typeof arg !== 'string') continue

        for (const pattern of dangerousPatterns) {
            if (pattern.test(arg)) {
                throw new Error(`Argument contains potentially dangerous characters: "${arg}"`)
            }
        }
    }
}

/**
 * Validates user-supplied env vars against the operator-controlled allow-list in
 * `CUSTOM_MCP_ALLOWED_ENV_VARS` (comma-separated names). Empty = none allowed.
 */
export const validateEnvironmentVariables = (env: Record<string, any>): void => {
    const allowedEnvVars = new Set(
        (process.env.CUSTOM_MCP_ALLOWED_ENV_VARS ?? '')
            .split(',')
            .map((s) => s.trim())
            .filter(Boolean)
    )

    for (const [key, value] of Object.entries(env)) {

View on GitHub (pinned to abe4a8601a)

Solutions

Strip or URL-encode shell metacharacters from user input before it becomes an MCP arg.
Pass structured values via env vars (allow-listed) rather than as command args.
If a legitimate arg needs characters like '(' or '{', base64-encode it and decode inside the script, or move the data out of args entirely.

Example fix

// before: user input passed raw
const processedArgs = userInput.trim().split(/\s+/)

// after: reject/encode metacharacters up front
const safe = userInput.replace(/[;&|`$(){}[\]<>]/g, '')
const processedArgs = safe.trim().split(/\s+/)

Defensive patterns

Strategy: validation

Validate before calling

const dangerous = arg => /[;&|`$(){}[\]<>]/.test(arg) || /&&|\|\|;;/.test(arg) || />>|<<|>/.test(arg) || /`|\$\(/.test(arg) || /<\(|>\(/.test(arg)
if (args.some(a => typeof a === 'string' && dangerous(a))) {
  throw new Error('Rejecting args containing shell metacharacters')
}

Type guard

const argsAreSafe = (args: string[]): boolean => !args.some(a => typeof a === 'string' && (/[;&|`$(){}[\]<>]/.test(a) || /&&|\|\|;;/.test(a) || />>|<<|>/.test(a) || /`|\$\(/.test(a) || /<\(|>\(/.test(a)))

Try / catch

try {
  validateCommandInjection(args)
} catch (e) {
  if (e.message.startsWith('Argument contains potentially dangerous characters')) {
    // sanitize or reject the offending arg before retrying
  }
  throw e
}

Prevention

Never pass free-form user text as command args; encode or move to env vars.
Run validateCommandInjection on user input at the UI boundary for early feedback.
Prefer structured config over string args.

When it happens

Trigger: validateCommandInjection(args) called from validateMCPServerConfig when serverParams.args is a non-empty array and any element contains a matched metacharacter. Reachable from any MCP node whose user input flows into args (e.g. Supergateway _args string).

Common situations: User types a command-like argument such as 'server.js; rm -rf /', pipes 'a | b', env expansion '$HOME', or redirection in the node's arguments field; a value legitimately containing parentheses or brackets (e.g. a JSON snippet) is passed as an arg.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/ef725088e4fd7fd6. Report an issue: GitHub.