CVE-2025-59528 - Vulnerability Analysis
CriticalCVSS: 10.0Last Updated: September 23, 2025
Overview
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation. Specifically, inside the convertToValidJSONString function, user input is directly passed to the Function() constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as child_process and fs. This issue has been patched in version 3.0.6.
Severity & Score
Social Media Activity(2 posts)
⚪️ Critical Flowise vulnerability is actively exploited in attacks 🗨️ Researchers have recorded the first attempted attacks on the Flowise AI platform using the critical vulnerability CVE-2025-59528, which is an arbitrary JavaScript code injection issue. This bug received the maximum score of 10 on the CVSS scale and has been… 🔗 https://hackmag.com/news/flowise-attacks?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials #news
View original post
⚪️ Critical Flowise vulnerability is actively exploited in attacks 🗨️ Researchers have recorded the first attempted attacks on the Flowise AI platform using the critical vulnerability CVE-2025-59528, which is an arbitrary JavaScript code injection issue. This bug received the maximum score of 10 on the CVSS scale and has been… 🔗 https://hackmag.com/news/flowise-attacks?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials #news
View original postGitHub Repositories(10 repos)
- https://github.com/secopssite/HTB
- https://github.com/zimshk/CVE-2025-59528.yaml
- https://github.com/jwsly12/CVE-2025-58434-59528-htb-ctf
- https://github.com/kartik2005221/CVE-2025-58434-AND-59528-POC
- https://github.com/TYehan/CVE-2025-58434-59528
- https://github.com/AzureADTrent/CVE-2025-58434-59528
- https://github.com/Kamigold/Flowise-RCE
- https://github.com/honney336/CVE-2025-58434_CVE-2025-59528
- https://github.com/vanhari/CVE-2025-59528
- https://github.com/UsifAraby/CVE-2025-59528-POC
Related Resources
Details
- CVE ID
- CVE-2025-59528
- Severity
- Critical
- CVSS Score
- 10.0
- EPSS
- 8239.0%
- Nuclei
- Available
- Social Posts
- 2