Executive brief
Flowise is an open-source tool used to build customized AI workflows and chatbots. A security flaw in how the software handles configuration settings on Windows systems allows an authorized user to bypass safety restrictions. By providing specifically formatted settings, an attacker can force the server to run malicious code, potentially leading to a full system takeover or unauthorized access to sensitive data handled by the AI workflows.
Technical details
Flowise versions prior to 3.1.3 implement a case-sensitive denylist for environment variables within the Custom Model Context Protocol (MCP) stdio configuration. On Windows, environment variable names are case-insensitive; therefore, an attacker can bypass the 'NODE_OPTIONS' restriction by using a lowercase variant like 'node_options'. By injecting 'node_options' with a '--require' flag, an authenticated user with permissions to configure Custom MCP nodes can achieve Remote Code Execution (RCE) in the context of the Flowise server process. The vulnerability was addressed in version 3.1.3 by moving from a hardcoded denylist to an operator-controlled allow-list (CUSTOM_MCP_ALLOWED_ENV_VARS).
Affected products
- FlowiseAI Flowise < 3.1.3
Timeline
- 2026-06-03: patched: Pull request 6471 merged to address the issue.
- 2026-06-27: advisory: VulnCheck published advisory.
- 2026-06-28: disclosed: CVE-2026-58057 published to NVD.