CVE-2026-73601

Flowise versions before 3.1.3 contain a remote code execution flaw (CWE-95, code/command injection) in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio. An authenticated user can trigger it by manipulating environment variables and command arguments — abusing PYTHONWARNINGS and BROWSER with python3, or leveraging the root working directory with node — to bypass the node's validation. Successful exploitation yields arbitrary system command execution with high impact on confidentiality, integrity, and availability of the host. Any Flowise deployment running an affected version that exposes flows using the Custom MCP node in stdio mode to authenticated users is affected. There is no known in-the-wild exploitation, no public proof-of-concept, the flaw is not in CISA KEV, and EPSS indicates a low (~0.9%) probability of exploitation in the next 30 days.

What to do: Upgrade Flowise to version 3.1.3 or later. Until patched, avoid the stdio protocol for the Custom MCP node (or restrict which authenticated users can edit/run such flows), review flows using Custom MCP, and limit access to Flowise instances — especially those reachable from the internet.