CVE record published for Flowise remote code execution via the Custom MCP node

A CVE record for Flowise, the open-source low-code platform for building LLM applications, was published to the National Vulnerability Database on 2026-08-13 as CVE-2026-73601, with a CVSS score of 9.0. It covers a remote code execution vulnerability in the platform's Custom MCP node, the component that lets a Flowise workflow attach an arbitrary MCP server configuration.

In Flowise versions before 3.1.3, when CUSTOM_MCP_PROTOCOL is set to stdio, an authenticated user can execute arbitrary commands by manipulating environment variables and command arguments in the node's MCP server configuration. The NVD description names two concrete routes: abusing the PYTHONWARNINGS and BROWSER environment variables with python3, and leveraging the root working directory with node, either of which bypasses the node's validation and executes system commands on the Flowise host.

FlowiseAI's own repository advisory, GHSA-g98q-rm45-q9h8, was published on 2026-07-29 and rates the vulnerability critical. The fix shipped in Flowise 3.1.3; the vendor's guidance is to upgrade.