Loading vulnerability…
Remote Code Execution in Flowise CustomMCP Configuration Parsing
CVE-2025-59528 is a JavaScript code injection vulnerability in Flowise's CustomMCP node, affecting versions from 2.2.7-patch.1 through 3.0.5. When parsing the user-controlled mcpServerConfig string, convertToValidJSONString passes input directly to the JavaScript Function() constructor without security validation. Crafted configuration data therefore executes as JavaScript with full Node.js runtime privileges, allowing access to process-execution and filesystem capabilities. The vulnerability was fixed in Flowise 3.0.6 and has been actively exploited in the wild.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of the Flowise service and resources accessible to its operating-system account. Attackers can execute commands, read or modify files, steal application secrets and business data, and disrupt workflows. Exposed integration credentials and network connectivity can enable further compromise of connected databases, cloud services, and third-party APIs. The extent of host compromise depends on the Flowise process's operating-system privileges and isolation.
If you can’t patch tonight, do this now.
Remove unnecessary public internet exposure and restrict Flowise API access to trusted networks or authorized clients. Enforce authentication and authorization, protect API tokens, and monitor for suspicious requests to the CustomMCP node-loading API. Run Flowise with least operating-system privilege and isolate it from sensitive resources to limit exploitation impact. These controls do not replace upgrading.
Patch, then assume compromise.
Upgrade Flowise to version 3.0.6 or a later supported release containing the fix. Where compromise is suspected, investigate the deployment and rotate associated API tokens, application secrets, and integration credentials; patching alone does not remove attacker-established access.
24 exploits validated by Mallory's analysis. Hidden: 7 rejected by Mallory's analysis as not a working exploit; 2 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
66 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.