CVE-2025-71336 | Flowise up to 3.0.5 Custom MCP Feature customMCP os command injection (GHSA-6933-jpx5-q87q)

June 26, 2026 Yanac

A vulnerability labeled as critical has been found in Flowise up to 3.0.5. The impacted element is an unknown function of the file /api/v1/node-load-method/customMCP of the component Custom MCP Feature. Executing a manipulation can lead to os command injection.

This vulnerability is tracked as CVE-2025-71336. The attack can be launched remotely. No exploit exists.

The affected component should be upgraded.VulDB Recent EntriesRead More