Attackers are exploiting a critical Flowise flaw, tracked as CVE-2025-59528 (CVSS score of 10), that lets them run malicious code and access systems due to poor validation of user-supplied JavaScript.

Attackers are actively exploiting a critical vulnerability in Flowise, tracked as CVE-2025-59528, that allows remote code execution and file system access. The flaw stems from improper validation of user-supplied JavaScript in a configuration function, exposing systems to full compromise.

Flowise is an open-source platform that lets users build and manage customized LLM (large language model) workflows and autonomous agents. It provides a drag-and-drop interface to design AI flows, connect models, and integrate external tools or APIs without deep programming knowledge. Essentially, it simplifies creating AI-driven applications and automated processes.

The CustomMCP node in Flowise lets users configure connections to external MCP servers, but it processes the mcpServerConfig input insecurely. Instead of validating it, the system executes it as JavaScript. The convertToValidJSONString function passes user input directly to the Function() constructor, running it with full Node.js privileges. This allows access to sensitive modules like child_process and fs, enabling command execution and file system access, making the flaw highly dangerous.

“The CustomMCP node allows users to input configuration settings for connecting to an external MCP (Model Context Protocol) server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation.” reads the advisory. “Specifically, inside the convertToValidJSONString function, user input is directly passed to the Function() constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as child_process and fs.”

The vulnerability lets attackers run arbitrary JavaScript on the Flowise server, leading to full system takeover, file access, command execution, and data theft. Since exploitation only requires an API token, it poses a severe risk to business operations and sensitive customer data.

The flaw impacts Flowise versions up to 3.0.5 and was fixed in version 3.0.6, released in September 2025.

VulnCheck detected first exploitation of CVE-2025-59528, the activity appears to come from a single Starlink IP, with 12,000–15,000 exposed instances online.

“New hashtag#KEV: Early this morning, VulnCheck‘s Canary network began detecting first-time exploitation of CVE-2025-59528, a CVSS-10 arbitrary JavaScript code injection vulnerability in Flowise, an open-source AI development platform. The vulnerability resides in the CustomMCP server logic in multiple versions of Flowise and allows for code execution.” Caitlin Condon, VP, Security Research at VulnCheck wrote on LinkedIn. “Observed activity so far originates from a single Starlink IP. Our team’s ASM queries show 12,000 – 15,000 instances of Flowise on the public internet as of today.”

CVE-2025-59528 is the third Flowise flaw actively exploited in the wild, following CVE-2025-8943 (CVSS score: 9.8) and CVE-2025-26319 (CVSS score: 8.9).

“This is a critical-severity bug in a popular AI platform used by a number of large corporations. This specific vulnerability has been public for more than six months, which means defenders have had time to prioritize and patch the vulnerability,” added Condon.” “The internet-facing attack surface area of 12,000+ exposed instances makes the active scanning and exploitation attempts we’re seeing more serious, as it means attackers have plenty of targets to opportunistically reconnoiter and exploit,” Condon said.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Flowise)

A critical Flowise RCE vulnerability is now being actively exploited. The flaw, tracked as CVE-2025-59528, carries a maximum severity rating and enables attackers to execute arbitrary code on affected systems, potentially leading to full system compromise.  Security researchers have confirmed that threat actors are taking advantage of the Flowise RCE vulnerability to infiltrate vulnerable deployments. This issue, identified as CVE-2025-59528, allows malicious actors to inject and execute arbitrary code through unsafe handling of user input within the platform.  The vulnerability was first publicly disclosed in September of last year, accompanied by warnings that successful exploitation could result in command execution and unauthorized access to the file system. Despite the availability of a patch, exploitation attempts have now been observed in real-world environments. 

Unsafe JavaScript Execution 

The issue arises in the Flowise CustomMCP node, a component designed to connect with external Model Context Protocol (MCP) servers. The vulnerability arises because the node unsafely evaluates user-supplied input in the mcpServerConfig setting.  This design flaw allows attackers to inject malicious JavaScript code without undergoing proper validation or security checks. As a result, attackers can leverage the Flowise RCE vulnerability (CVE-2025-59528) to execute arbitrary code, potentially gaining control over the affected system.  The developers addressed the vulnerability in Flowise version 3.0.6. The latest available version, 3.1.1, was released two weeks ago and includes the necessary fixes.  Flowise itself is a low-code, open-source platform used to build AI agents and large language model (LLM) workflows. It features a drag-and-drop interface that enables users to design pipelines for chatbots, automation tools, and other AI-driven systems.

Evidence of Flowise RCE Vulnerability 

According to Caitlin Condon, VP of Security Research at VulnCheck, exploitation activity has already begun. She stated:  “New hashtag#KEV: Early this morning, VulnCheck's Canary network began detecting first-time exploitation of CVE-2025-59528, a CVSS-10 arbitrary JavaScript code injection vulnerability in Flowise, an open-source AI development platform. The vulnerability resides in the CustomMCP server logic in multiple versions of Flowise and allows for code execution.”  She further noted:  “Observed activity so far originates from a single Starlink IP. Our team's ASM queries show 12,000 - 15,000 instances of Flowise on the public internet as of today. CVE-2025-59528 is patched in version 3.0.6 of Flowise.”  This suggests that while exploitation is currently limited, the attack surface remains significant due to the large number of exposed instances. 

Additional Vulnerabilities Increase Risk 

The Flowise RCE vulnerability (CVE-2025-59528) is not the only security concern affecting the platform. Researchers have also observed active exploitation of two other vulnerabilities: CVE-2025-8943 and CVE-2025-26319.  Condon emphasized that both of these flaws are included in VulnCheck’s Known Exploited Vulnerabilities (KEV) catalog and have been detected through their monitoring systems. This indicates a broader pattern of attackers targeting Flowise deployments to execute arbitrary code and gain unauthorized access.  Although estimates suggest that between 12,000 and 15,000 Flowise instances are accessible on the public internet, it remains unclear how many of these are vulnerable to CVE-2025-59528.  Even so, the presence of such a large number of exposed systems increases the likelihood of further attacks, especially as exploit techniques become more widely available. 

Recommendations for Users

Users of Flowise are strongly advised to take immediate action to mitigate the risks associated with CVE-2025-59528. Upgrading to version 3.1.1, or at a minimum version 3.0.6, is critical to patch the Flowise RCE vulnerability and prevent attackers from exploiting it to execute arbitrary code.  Additionally, organizations should evaluate whether their Flowise instances need to be publicly accessible. If external access is not required, removing these systems from the public internet can significantly reduce exposure to attacks.