Flowise MCP RCE is not just another patch note. It is a warning about how agent builders handle Model Context Protocol servers, especially STDIO-based tools. The full TokenMix.ai version is here: Flowise MCP RCE: 10 Fixes for CVE-2026-40933 and Upsonic . Short version: Patch Flowise to 3.1.0 or later. Patch Upsonic to 0.72.0 or later. Do not treat MCP STDIO as harmless configuration. Do not rely on input sanitization as the main control. Treat any user-configurable STDIO MCP server like a process execution surface. That last point is the real lesson. What Happened Flowise CVE-2026-40933 affects Flowise and flowise-components versions up to 3.0.13, according to the GitHub Advisory Database. The patched version is 3.1.0. Upsonic CVE-2026-30625 affects versions before 0.72.0, according to Snyk. The fixed version is 0.72.0.…