CVE-2025-59528

What it actually does

Flowise 3.0.5 contains a remote code execution flaw in the CustomMCP node. The node accepts a user-controlled mcpServerConfig string and passes it through convertToValidJSONString, where the input is evaluated with JavaScript's Function() constructor instead of being parsed as data. Because this evaluation occurs inside the Flowise Node.js process, attacker-supplied JavaScript can execute with the same privileges as the Flowise service account, including access to Node.js modules such as child_process and fs. Successful exploitation can allow command execution, file read/write, credential theft from environment variables or local configuration, modification of flows, and pivoting to connected services or internal network resources reachable from the Flowise host.

Why it matters to the business

A vulnerable Flowise deployment can be turned into an attacker-controlled execution point. This may lead to service disruption, theft of API keys and LLM provider credentials, exposure or manipulation of AI workflows, unauthorized access to connected data sources, and lateral movement into adjacent systems. The risk is high because the exploit is reported as weaponized and the EPSS score is very high, indicating a strong likelihood of exploitation in the wild even though it is not currently listed in CISA KEV. Organizations using Flowise for production automation, AI agents, integrations, or access to sensitive internal tools should treat this as an urgent remediation item.

How an attack unfolds

An attacker first identifies a reachable Flowise instance running the vulnerable 3.0.5 code path and obtains access to functionality that can create or modify a flow using the CustomMCP node. The attacker supplies a malicious mcpServerConfig value that is crafted to be evaluated as JavaScript rather than treated as configuration data. When Flowise processes the node configuration, convertToValidJSONString invokes the Function() constructor on the attacker-controlled input. The payload then runs inside the Flowise Node.js runtime and can import dangerous modules, execute operating system commands, read local files, enumerate environment variables, or establish outbound network connections. After initial code execution, the attacker may retrieve secrets used by Flowise, alter existing AI workflows, deploy persistence through modified flow definitions or startup scripts, and use the server's network position to reach additional internal services.

How to fix it

Upgrade Flowise immediately to version 3.0.6 or later. For source-based deployments, ensure the code includes the upstream fix at commit 89a0f23fe5e9c0b1ee85ee1175032c6b9e5ac9c1 or a later trusted commit. Rebuild and redeploy containers or packages from clean sources rather than patching running instances in place. If Debian package inventory reports rsync as affected in this feed, validate the package mapping separately because the described vulnerability is in Flowise; where applicable, apply the listed Debian rsync package fix 3.1.0-3, but prioritize Flowise remediation for this issue. Until upgrade is complete, restrict access to Flowise administrative and flow-editing interfaces, disable or remove CustomMCP node usage where possible, require authentication, block public internet exposure, and enforce egress filtering from Flowise hosts. After patching, rotate secrets accessible to Flowise, including LLM provider keys, database credentials, integration tokens, MCP server credentials, and any environment variables present on the host.

How to confirm the fix worked

Confirm the deployed Flowise version is 3.0.6 or later, or verify the running source tree includes commit 89a0f23fe5e9c0b1ee85ee1175032c6b9e5ac9c1 or a later fix. Check container images, package manifests, lockfiles, and runtime banners rather than relying only on repository state. Review whether any active or saved flows contain CustomMCP nodes and inspect their mcpServerConfig values for executable JavaScript patterns. Validate that the vulnerable implementation no longer passes user-controlled configuration into Function(), eval(), or equivalent dynamic execution primitives. Test access controls to ensure untrusted users cannot create or modify CustomMCP node configurations. Confirm network controls prevent unnecessary inbound access to Flowise and restrict outbound connections from the Flowise runtime. After remediation, restart the service, verify the fixed build is running, and perform secret rotation if exploitation cannot be confidently ruled out.

Typical attack path

1. Discover an exposed or accessible Flowise instance.
2. Determine that the instance is running vulnerable Flowise 3.0.5 or code prior to the fixed commit/version.
3. Authenticate if required, or abuse any exposed flow-building/API functionality that permits creation or modification of a CustomMCP node.
4. Submit a malicious mcpServerConfig value containing JavaScript intended for evaluation.
5. Trigger processing or execution of the CustomMCP node so convertToValidJSONString evaluates the payload through Function().
6. Execute commands or JavaScript with the privileges of the Flowise Node.js process.
7. Collect environment variables, local configuration files, API tokens, flow definitions, and connected service credentials.
8. Modify flows, stage additional tools, create outbound command-and-control connections, or pivot to internal systems reachable from the Flowise host.

How to detect it

Investigate both application-layer artifacts and host-level execution evidence. Review Flowise access logs, reverse proxy logs, API gateway logs, and application logs for requests that create, update, import, or execute flows containing CustomMCP nodes or mcpServerConfig values. Pay particular attention to payloads containing JavaScript execution constructs, Node.js module loading, child_process usage, filesystem access, environment-variable access, or shell command strings. Inspect saved flow definitions and any exported/imported flow JSON for malicious CustomMCP configuration. On the host or container, review process creation telemetry for child processes spawned by node or the Flowise service, including shells and download utilities. Check EDR, auditd, Sysmon, container runtime logs, Kubernetes audit logs, and cloud workload logs for unexpected outbound connections, file writes, credential access, or process trees where node launches /bin/sh, bash, cmd.exe, powershell.exe, curl, wget, nc, python, perl, or similar utilities. Examine environment variable exposure, local credential files, Flowise configuration files, and integration tokens for access or exfiltration. If Flowise runs in containers, inspect container logs, image layers, mounted volumes, modified entrypoints, and abnormal exec events. Because exploitation may execute arbitrary commands without a stable malware artifact, prioritize behavior-based hunting over reliance on fixed indicators.

• CustomMCP
• mcpServerConfig
• convertToValidJSONString
• Function(
• require('child_process')
• require("child_process")
• child_process.exec
• child_process.execSync
• child_process.spawn
• require('fs')
• require("fs")
• process.env
• process.mainModule
• global.process
• constructor.constructor
• /bin/sh -c
• bash -c
• curl http
• curl https
• wget http
• wget https
• nc -e
• ncat -e
• powershell -enc
• cmd.exe /c
• node -> /bin/sh
• node -> bash
• node -> curl
• node -> wget
• node -> nc
• node -> powershell.exe

What your security team should do

• Prioritize emergency upgrade of all Flowise 3.0.5 deployments to 3.0.6 or later because exploit maturity is weaponized and EPSS is very high.
• Inventory all Flowise instances, including containerized, self-hosted, development, staging, and source-built deployments.
• Temporarily remove public exposure and restrict Flowise administrative/API access to trusted networks and authenticated users only.
• Search saved flows, API request logs, and application logs for suspicious CustomMCP and mcpServerConfig content before and after patching.
• Rotate all secrets available to the Flowise process if the instance was reachable by untrusted users or if logs are insufficient to rule out compromise.
• Review host telemetry for child processes spawned by the Flowise/Node.js process, especially shells, curl, wget, nc, python, perl, or PowerShell.
• Apply egress filtering so Flowise can connect only to required MCP servers, LLM providers, databases, and approved integration endpoints.
• Preserve logs and container/host forensic artifacts before redeployment if exploitation is suspected.
• Hunt for modified flow definitions, unauthorized new flows, unexpected MCP server configurations, and changes to startup files or container entrypoints.
• Validate any Debian rsync package findings independently because the vulnerability description maps to Flowise, not rsync, while still applying applicable package updates from trusted distribution channels.