Flowise versions before 3.1.3 validate Custom MCP stdio environment variables against a denylist using a case‑sensitive comparison. On Windows, where environment names are case‑insensitive, an attacker can provide 'node_options' to bypass the NODE_OPTIONS denylist entry. An authenticated user who can configure a Custom MCP node can inject a NODE_OPTIONS value containing --require and thereby execute arbitrary JavaScript code in the Flowise server process. This vulnerability falls under CWE‑178 and allows attacker control of the server context through authority to modify node configuration.

The impacted product is Flowise, with all releases prior to version 3.1.3. The issue manifests on Windows operating systems, as the environment variable names are treated case‑insensitively, creating the bypass. No other operating systems or product versions are affected according to the available data.

The CVSS score of 2.3 indicates a low overall severity, largely because the vulnerability requires authentication and is limited to the Flowise server environment. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is an authenticated Flowise user who has permission to edit Custom MCP nodes; such a user can supply a crafted environment variable name and value to trigger arbitrary code execution.