CVE-2026-73601High· 8.8▾ TwilightFlowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.9%
0.9% → 1.1%
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and BROWSER environment variables with python3, or leverage the root working directory with node to bypass validation and execute system commands.
flowise < 3.1.3Upgrade past the affected range:
flowise 3.1.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73602Critical· 9.9Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass
CVE-2026-69264Critical· 9.8Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide
CVE-2026-69253High· 8.8Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows
GHSA-6j9g-8fxc-25hqCritical· 8.8Duplicate Advisory: Flowise contains an unauthenticated sandbox escape
GHSA-x3jw-7gj7-qv6mCritical· 9.8Duplicate Advisory: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
CVE-2026-73483CriticalFlowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium