A vulnerability labeled as critical has been found in Flowise up to 3.0.5 . The impacted element is an unknown function of the file /api/v1/node-load-method/customMCP of the component Custom MCP Feature . Executing a manipulation can lead to os command injection. This vulnerability is tracked as CVE-2025-71336 . The attack can be launched remotely. No exploit exists. The affected component should be upgraded.