SCA: security update for flowise (GHSA-3gcm-f6qx-ff7p)

critical Tenable Self-Hosted Container Security Plugin ID 435318

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5,
Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration
settings for connecting to an external MCP server. This node parses the user-provided mcpServerConfig
string to build the MCP server configuration. However, during this process, it executes JavaScript code
without any security validation. Specifically, inside the convertToValidJSONString function, user input is
directly passed to the Function() constructor, which evaluates and executes the input as JavaScript code.
Since this runs with full Node.js runtime privileges, it can access dangerous modules such as
child_process and fs. This issue has been patched in version 3.0.6. (CVE-2025-59528)

Plugin Details

Severity: Critical

ID: 435318

Version: Revision 1.12

Type: Local

Family: SCA Checks

Published: 9/16/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 8

Percentile: 99.68

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-59528

CVSS v3

Risk Factor: Critical

Base Score: 10

Temporal Score: 9.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 9/15/2025

Exploitable With

Metasploit (Flowise JS Injection RCE)

Reference Information

CVE: CVE-2025-59528

cwe: CWE-94

Detections

Analytics