Detections
Analytics
CVE-2025-59528
critical
Description
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation. Specifically, inside the convertToValidJSONString function, user input is directly passed to the Function() constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as child_process and fs. This issue has been patched in version 3.0.6.
References
https://www.securityweek.com/critical-flowise-vulnerability-in-attacker-crosshairs/
https://thehackernews.com/2026/04/flowise-ai-agent-builder-under-active.html
https://github.com/Neverland-lcl/Security_OS_CVE
https://github.com/Neverland-lcl/Security_OS
https://github.com/SuriyaBoon/HackTheBox-Silentium
https://github.com/v3rycl0p3r/CVE-PoC-CVE-2025-58434
https://github.com/0xDaeras/Flowise-CVE-2025-58434-Chain-59528
https://github.com/karimelsheikh1/HTB-Silentium-Writeup
https://github.com/r3nsi15/Flowise-RCE-CVE-2025-59528
https://github.com/maradonam18/-CVE-2025-59528-PoC
https://github.com/0xsyr0/AI-Exploit-Forge-Collection
https://github.com/honney336/CVE-2025-58434_CVE-2025-59528
https://github.com/UsifAraby/CVE-2025-59528-POC
https://github.com/kartik2005221/CVE-2025-58434-AND-59528-POC
https://github.com/0dgt/CVE-2025-8110
https://github.com/jwsly12/CVE-2025-58434-59528-htb-ctf
https://github.com/TYehan/CVE-2025-58434-59528
https://github.com/CVETeam/FlowiseAI-Critical-KillChain
https://github.com/Kamigold/Flowise-RCE
https://github.com/AzureADTrent/CVE-2025-58434-59528
https://github.com/secopssite/HTB
https://github.com/B1ack4sh/Blackash-CVE-2025-59528
https://github.com/Ashwesker/Blackash-CVE-2025-59528
https://github.com/zimshk/CVE-2025-59528.yaml
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p
https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6