A vulnerability labeled as critical has been found in Flowise up to 3.0.5. The impacted element is an unknown function of the file /api/v1/node-load-method/customMCP of the component Custom MCP Feature. Executing a manipulation can lead to os command injection. This vulnerability is tracked as CVE-2025-71336. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.
| Vendor | Product | Versions |
|---|---|---|
| flowi | flowise | 0, 3.0.5 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| open source | open source flowise | cert_advisory | 90% |
Updated severity to CRITICAL, added affected version 3.0.5, and corrected exploit availability to false.
Initial creation
