https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T03:43:30.057410+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-58057 CVE-2026-58057 — Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity 2026-10-06T03:43:30.072754+00:00

Affected: Flowise

Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitive comparison, so on Windows, where environment names are case-insensitive, supplying 'node_options' bypasses the NODE_OPTIONS denylist entry. An authenticated user who can configure a Custom MCP node can thereby inject NODE_OPTIONS --require and execute arbitrary code in the Flowise server context.