Advisory details:
github_osv / GHSA-3gcm-f6qx-ff7p
| Advisory ID | github_osv/GHSA-3gcm-f6qx-ff7p |
| Aliases |
CVE-2025-59528
|
| Summary | Flowise has Remote Code Execution vulnerability ## Description ### Cause of the Vulnerability The `CustomMCP` node allows users to input configuration settings for connecting to an external MCP (Model Context Protocol) server. This node parses the user-provided `mcpServerConfig` string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation. Specifically, inside the `convertToValidJSONString` function, user input is directly passed to the `Function()` constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as `child_process` and `fs`. ### Vulnerability Flow 1. **User Input Received**: Input is provided via the API endpoint `/api/v1/node-load-method/customMCP` through the `mcpServerConfig` parameter. 2. **Variable Substitution**: The `substituteVariablesInString` function replaces template variables like `$vars.xxx`, but no security filtering is applied during this step. 3. **Dangerous Code Execution**: The `convertToValidJSONString` function executes the input using `Function('return ' + inputString)()`. If the `inputString` contains malicious code, it gets executed in the global Node.js context, allowing actions such as command execution and file system access. ## Taint Flow - **Taint 01: Route Registration** [`index.ts` (Line 5)](https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/routes/node-load-methods/index.ts#L5) - **Taint 02: Controller** [`index.ts` (Line 57–78)](https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/controllers/nodes/index.ts#L57-L78) - **Taint 03: Service** [`index.ts` (Line 91–94)](https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/services/nodes/index.ts#L91-L94) - **Taint 04: CustomMCP Node Entry Point** [`CustomMCP.ts` (Line 132)](https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L132) - **Taint 05: Variable Substitution** [`CustomMCP.ts` (Line 220)](https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L220) - **Taint 06: Dangerous Constructor Execution** [`CustomMCP.ts` (Line 262–270)](https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L262-L270) ## Proof of Concept (PoC) ```bash curl -X POST http://localhost:3000/api/v1/node-load-method/customMCP \ -H "Content-Type: application/json" \ -H "Authorization: Bearer tmY1fIjgqZ6-nWUuZ9G7VzDtlsOiSZlDZjFSxZrDd0Q" \ -d '{ "loadMethod": "listActions", "inputs": { "mcpServerConfig": "({x:(function(){const cp = process.mainModule.require(\"child_process\");cp.execSync(\"echo !!RCE-OK!! >/tmp/RCE.txt\");return 1;})()})" } }' ``` <img width="1907" height="958" alt="image" src="https://github.com/user-attachments/assets/78b50eb1-67af-4c8b-97ea-7e2c05426962" /> When executed, this creates a file `/tmp/RCE.txt` on the server, confirming command execution. ## Impact ### Complete System Takeover and Infrastructure Threat This vulnerability allows attackers to execute arbitrary JavaScript code on the Flowise server, leading to: - Full system compromise - File system access - Command execution - Sensitive data exfiltration As only an API token is required, this poses an extreme security risk to business continuity and customer data. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 9.0 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 10.0 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-3gcm-f6qx-ff7p/GHSA-3gcm-f6qx-ff7p.json |
| generic_textual | CRITICAL |
| Data source | Exploit-DB |
|---|---|
| Date added | Oct. 31, 2025 |
| Description | Flowise 3.0.4 - Remote Code Execution (RCE) |
| Ransomware campaign use | Unknown |
| Source publication date | Oct. 31, 2025 |
| Exploit type | webapps |
| Platform | multiple |
| Source update date | Oct. 31, 2025 |
| Data source | Metasploit |
|---|---|
| Description | This module exploits a remote code execution vulnerability in Flowise versions >= 2.2.7-patch.1 and < 3.0.6. The vulnerability exists in the customMCP endpoint (/api/v1/node-load-method/customMCP) located in packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts, which allows users to execute arbitrary commands via JavaScript code injection in the mcpServerConfig parameter using the convertToValidJSONString function that uses Function('return ' + inputString)(). For versions < 3.0.1, the exploit can work unauthenticated if FLOWISE_USERNAME and FLOWISE_PASSWORD environment variables are not configured. For versions >= 3.0.1, authentication via FLOWISE_EMAIL and FLOWISE_PASSWORD is required due to JWT token verification. |
| Note | Stability: - crash-safe Reliability: - repeatable-session SideEffects: - ioc-in-logs |
| Ransomware campaign use | Unknown |
| Source publication date | Sept. 13, 2025 |
| Platform | Linux,Unix,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/flowise_js_rce.rb |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-09-22T20:23:40Z/
Decision: Track*
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2025/59xxx/CVE-2025-59528.json
Source Advisory: vulnrichment/CVE-2025-59528
[{'Exploitation': 'poc'},
{'Automatable': 'yes'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]