Flowise MCP node_options env var case bypass spawning Node.js child with --require

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•5

Detects the exploitation of CVE-2026-20253, where the Flowise application fails to correctly sanitize or validate environment variables. By using a case-insensitive bypass (e.g., lowercase 'node_options'), an attacker can cause a spawned Node.js child process to honor the variable and execute unauthorized JavaScript files via the '--require' command-line argument.