{"action":"Upgrade flowise to 3.0.6 or later.","affected":[{"fixed":"3.0.6","introduced":"2.2.7-patch.1"}],"component":"flowise","cve_ids":["CVE-2025-71336"],"ecosystem":"npm","epss":0.01148,"exploited":false,"fixed_versions":["3.0.6"],"ghsa_id":"GHSA-6933-jpx5-q87q","id":"tcs_01M5KF6EP3YHWS5QBRFD9XA6CJ","modified_at":"2026-07-08T07:35:36.876785076Z","published_at":"2025-09-15T20:30:30Z","references":["https://osv.dev/vulnerability/GHSA-6933-jpx5-q87q","https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6933-jpx5-q87q","https://github.com/FlowiseAI/Flowise/pull/5201","https://github.com/FlowiseAI/Flowise/commit/ac7cf30e019cde54905bf09b5d3fe1c6ba42f9b9","https://github.com/FlowiseAI/Flowise","https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-6933-jpx5-q87q","url":"https://osv.dev/vulnerability/GHSA-6933-jpx5-q87q"},{"source":"nvd","source_id":"CVE-2025-71336","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71336"}],"summary":"Flowise has unsandboxed remote code execution via Custom MCP"}