CVE-2025-59528

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.6

Description Flowise is a drag-and-drop user interface used to build customized large language model flows. A critical issue exists in the CustomMCP node, which allows users to input configuration settings for connecting to an external Model Context Protocol (MCP) server. The node parses the mcpServerConfig string to build the server configuration but executes JavaScript code without security validation. Specifically, the convertToValidJSONString() function passes user input directly to the Function() constructor, which evaluates and executes the input as JavaScript code with full Node.js runtime privileges. This allows access to dangerous modules such as child process and fs, enabling remote code execution, full system compromise, and unauthorized file system access. The issue is accessible via the API endpoint /api/v1/node-load-method/customMCP through the mcpServerConfig parameter. It is estimated that between 12,000 and 15,000 internet-facing instances are potentially affected, and active exploitation in the wild has been observed.

Recommendations Update Flowise to version 3.0.6 or later. As a temporary workaround, disable or restrict access to the CustomMCP node and the /api/v1/node-load-method/customMCP endpoint. Revoke and rotate API tokens and credentials. Restrict management and API endpoints behind a VPN, IP allowlists, or a Web Application Firewall (WAF).