CVE-2025-59528

Scores

EPSS

0.784medium78.4%
0%20%40%60%80%100%

Percentile: 78.4%

CVSS

10.0critical3.x
0246810

CVSS Score: 10.0/10

All CVSS Scores

CVSS 3.x
10.0

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation. Specifically, inside the convertToValidJSONString function, user input is directly passed to the Function() constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as child_process and fs. This issue has been patched in version 3.0.6.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

anchore_overridesnvd

CWEs

CWE-94

Exploits

Exploit ID: 52440

Source: exploitdb

URL: https://www.exploit-db.com/exploits/52440

Exploit ID: CVE-2025-59528

Source: github-poc

URL: https://github.com/zimshk/CVE-2025-59528.yaml

Vulnerable Software (2)

Type: Configuration

Operating System:

Trait:
{  "children": [    {      "cpe_match": [        {          "cpe23uri": "cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:node.js:*:*",          "versionEndExcluding": "3.0.6",          "versionStartInclu...

Source: anchore_overrides

Type: Configuration

Vendor: flowiseai

Product: flowise

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:flowiseai:flowise:3.0.5:*:*:*:*:*:*:*",      "vulnerable": true    }  ],  "operator": "OR"}

Source: nvd