Flowise versions before 3.1.2 contain multiple OS command injection vulnerabilities within the Custom MCP Server feature. These vulnerabilities stem from incomplete command-flag validation and a regex bypass in local file access restrictions. Attackers with any Flowise account role or API access with view/update permissions for chatflows can exploit these flaws to execute arbitrary commands on the host system. The validateCommandFlags blocklist does not properly restrict commands such as 'docker build' and 'npx --yes', while the validateArgsForLocalFileAccess checks can be bypassed. This allows for unauthorized execution of commands, potentially leading to system compromise. The CVSS score of 9.9 indicates a critical severity level, emphasizing the urgency of mitigation. Organizations utilizing Flowise should immediately upgrade to version 3.1.2 or later to address this vulnerability and prevent potential exploitation. No workaround is available aside from applying the patch.