Dashboard / CVE-2026-73601

CVE-2026-73601

CRITICAL
INFO Priority: 0.10 BB Relevance: 68/100
Published: 2026-08-13 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: Present
VC: High
VI: High
VA: High

Description

Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and BROWSER environment variables with python3, or leverage the root working directory with node to bypass validation and execute system commands.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
flowiseai flowise < 3.1.3

References & Advisories (2)

Bug Bounty Relevance

68 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

9.0 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

1.10%
Raw Score 0.010990
Percentile 65.6%
Date 2026-10-29

EPSS Trend

2026-10-29
0.01099
2026-10-28
0.01099

Intelligence Sources

nvd ref →

External Links