EUVD-2026-39977
GHSA-rqqr-m697-6jq3
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector for remote authenticated user; AC:H for Windows-only platform plus opt-in stdio requirement; PR:L for authenticated user; scope changed as injected code executes in server OS process.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
6DescriptionCVE.org
Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitive comparison, so on Windows, where environment names are case-insensitive, supplying 'node_options' bypasses the NODE_OPTIONS denylist entry. An authenticated user who can configure a Custom MCP node can thereby inject NODE_OPTIONS --require and execute arbitrary code in the Flowise server context.
AnalysisAI
Arbitrary code execution in Flowise before 3.1.3 on Windows allows an authenticated user with Custom MCP node configuration access to bypass the NODE_OPTIONS environment variable denylist by supplying the lowercase variant 'node_options', exploiting a case-sensitive string comparison against a case-insensitive OS. The injected NODE_OPTIONS --require directive causes the Flowise server process to load an attacker-controlled module when spawning a Custom MCP stdio child process. A publicly available proof-of-concept exists per VulnCheck; the vulnerability is not listed in CISA KEV, and exploitation is constrained by Windows platform dependency and the requirement for stdio mode to be explicitly enabled.
Technical ContextAI
Flowise is an open-source visual LLM orchestration platform (cpe:2.3:a:flowise:flowise:*:*:*:*:*:*:*:*). Its Custom MCP (Model Context Protocol) node supports a stdio transport that spawns child processes with user-supplied environment variables. To prevent abuse of dangerous Node.js runtime variables such as NODE_OPTIONS, Flowise maintained a string denylist checked at configuration time. The root cause is CWE-178 (Improper Handling of Case Sensitivity): the denylist comparison used case-sensitive exact-match logic, but Windows environment variable names are case-insensitive at the OS level - so 'node_options' and 'NODE_OPTIONS' are the same variable to the runtime but different strings to the validator. The NODE_OPTIONS --require flag is a well-known Node.js mechanism that forces require() of a specified module before any other code runs, enabling arbitrary code injection into any spawned Node.js process. The fix in PR #6471 replaces the denylist paradigm entirely with an explicit allowlist controlled by the CUSTOM_MCP_ALLOWED_ENV_VARS operator configuration, defaulting to no permitted variables.
RemediationAI
Vendor-released patch: Flowise 3.1.3. Upgrade to 3.1.3 or later immediately, particularly for any Windows-hosted deployments with authenticated users who have Custom MCP node configuration access. The patch at https://github.com/FlowiseAI/Flowise/pull/6471 replaces the denylist with an explicit allowlist (CUSTOM_MCP_ALLOWED_ENV_VARS), defaulting to no permitted environment variables, which eliminates the denylist bypass class entirely. If immediate upgrade is not possible, the most effective compensating control is to ensure CUSTOM_MCP_PROTOCOL is not set to 'stdio' - the patch also enforces that stdio mode requires the explicit CUSTOM_MCP_PROTOCOL=stdio setting, so instances not explicitly enabling stdio are not reachable; however, note that reverting to SSE transport may limit Custom MCP functionality. As a secondary control, restrict Custom MCP node configuration access to fully trusted, privileged users only, acknowledging that the stdio mode comment in the patched .env.example now warns: 'stdio can run arbitrary commands on your server, enable only if you trust all users'.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise pr
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Same weakness CWE-178 – Improper Handling of Case Sensitivity
View allShare
External POC / Exploit Code
Leaving vuln.today