The vulnerability is a command injection flaw in the Custom MCP node of Flowise, classified under CWE-95. When the CUSTOM_MCP_PROTOCOL environment variable is set to stdio, authenticated users can manipulate environment variables such as PYTHONWARNINGS and BROWSER or the root working directory to execute arbitrary system commands by passing crafted arguments to Python or Node. This flaw allows attackers to gain full code execution, compromising confidentiality, integrity, and availability of the affected system.

The vulnerable product is FlowiseAI Flowise. All releases before version 3.1.3 are affected; the flaw resides in the Custom MCP node that is invoked when the protocol is configured as stdio.

The CVSS score of 9 indicates critical severity, and while an EPSS score is not available, the lack of a KEV listing does not reduce the risk. Authenticated attackers can exploit the flaw by sending requests that set malicious environment variables or specify dangerous command arguments, likely through the web or API interface that exposes the Custom MCP node. With remote code execution possible, the vulnerability poses a high likelihood of widespread compromise if not patched.