CVE-2025-59528 in the critical feed json
Flowise has Remote Code Execution vulnerability
published 2025-09-15 13 mo ago modified 2026-10-18 21 d ago also EUVD-2025-29246 , GHSA-3gcm-f6qx-ff7p
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 87.0%
- EPSS 87.0% chance of exploitation in 30 days, percentile 99.7%
- public exploits
- 2
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation. Specifically, inside the convertToValidJSONString function, user input is directly passed to the Function() constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as child_process and fs. This issue has been patched in version 3.0.6.
Patch / fix
- npm flowise 3.0.6
- flowiseai flowise 3.0.6
Timeline
- First public exploit (Metasploit exploit/multi/http/flowise_js_rce)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 13 mo ago
Exploit prediction
86.98% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/flowise_js_rce Flowise JS Injection RCE metasploit exploit, excellent rank, 2025-09-13
- EDB-52440 Flowise 3.0.4 - Remote Code Execution (RCE) webapps, 2025-10-31
- Nuclei template Flowise - Remote Code Execution nuclei detection template
- github.com https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | flowise | >=3.0.5, <3.0.6 |
3.0.6 |
Affected products
- FlowiseAI Flowise
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p
web, exploit, vendor-advisory
-
github.com
/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP
web, product
-
github.com
/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP
web, product
-
github.com
/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP
web, product
-
github.com
/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/controllers/nodes/index.t
web, product
-
github.com
/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/routes/node-load-methods/
web, product
-
github.com
/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/services/nodes/index.ts#L
web, product
-
github.com
/FlowiseAI/Flowise/releases/tag/flowise%403.0.6
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2025-59528
advisory
-
github.com
/FlowiseAI/Flowise
package
Sources
- CVE List CVE-2025-59528
- GitHub Advisory GHSA-3gcm-f6qx-ff7p
- NVD CVE-2025-59528
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.