What is GHSA-m2vg-4724-xj8g?

GHSA-m2vg-4724-xj8g is a security advisory published by GitHub Security Advisories with Critical severity. Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP...

Which CVE IDs does GHSA-m2vg-4724-xj8g cover?

GHSA-m2vg-4724-xj8g covers the following CVE IDs: CVE-2026-73601. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-m2vg-4724-xj8gCritical

Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP...

Vendor

GitHub Security Advisories

Published

August 13, 2026

Last Modified

August 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-73601 →

📋 Description

Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and BROWSER environment variables with python3, or leverage the root working directory with node to bypass validation and execute system commands.

🔗 References (4)

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-g98q-rm45-q9h8
https://nvd.nist.gov/vuln/detail/CVE-2026-73601
https://www.vulncheck.com/advisories/flowise-before-remote-code-execution-via-custom-mcp
https://github.com/advisories/GHSA-m2vg-4724-xj8g