CVE-2025-71336
1 advisory.
npm/flowise CVE-2025-71336: high, EPSS 1.15%
Flowise has unsandboxed remote code execution via Custom MCP
Action: Upgrade flowise to 3.0.6 or later.
npm i flowise@3.0.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.2.7-patch.1 | 3.0.6 | - |
Fixed versions
| 3.0.6 |
Sources
- osv: GHSA-6933-jpx5-q87q
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6933-jpx5-q87q
- https://github.com/FlowiseAI/Flowise/pull/5201
- https://github.com/FlowiseAI/Flowise/commit/ac7cf30e019cde54905bf09b5d3fe1c6ba42f9b9
- https://github.com/FlowiseAI/Flowise
- https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6
CVE-2025-71336 · published · modified · JSON