Flowise MCP node_options Case-Bypass Enabling Node.js Code Execution

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects unauthorized execution of node.exe by the Flowise process, where a case-insensitive environment variable (node_options) is used to bypass Flowise's security block list. This enables attackers to leverage the --require flag to preload malicious JavaScript code. The detection also monitors for the presence of a 'flowise_marker.txt' file as a secondary indicator.