CVE-2025-59528

Flowise, an open-source drag-and-drop interface for building LLM agent flows, contains a critical remote code execution flaw (CWE-94, code injection) in its CustomMCP node. The node parses the user-supplied mcpServerConfig string, and the convertToValidJSONString helper passes this input directly to the JavaScript Function() constructor without any validation, causing it to be evaluated and executed as live code. Because the evaluation runs with full Node.js runtime privileges, an attacker can invoke dangerous modules such as child_process and fs to execute arbitrary commands on the host. Any Flowise deployment running version 3.0.5 or earlier is affected, and the CVSS vector (network attack vector, no privileges or user interaction required, scope change) indicates unauthenticated remote attackers can trigger it. Exploitation is active in the wild according to news reports citing roughly 12,000 exposed instances, and EPSS assigns an 87.4% probability of exploitation within 30 days.

What to do: Upgrade Flowise to version 3.0.6 or later immediately. Given confirmed in-the-wild exploitation, review internet-exposed instances for signs of compromise (unexpected processes, spawned shells, or modified files) and restrict access to CustomMCP-configured instances behind authentication or a VPN until patched. The flaw is not yet listed in CISA KEV, but defenders should treat patching as urgent given the CVSS 10.0 rating and 87.4% EPSS score.