CVE-2025-59528: Flowise CustomMCP node code injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a CVSS score of 10, high EPSS and public exploit material makes this an urgent patch.

What it is

Flowise 3.0.5 passes user-supplied mcpServerConfig input directly into the JavaScript Function() constructor inside convertToValidJSONString, with no validation. Because the evaluated code runs with full Node.js privileges, an attacker can reach child_process and fs and execute arbitrary commands on the host. The flaw is fixed in 3.0.6.

Impact

An attacker gains arbitrary code execution on the Flowise server with the privileges of the Node.js process, allowing command execution, file read/write and further host compromise.

Attack surface

The CVSS vector is network-reachable with no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), so the CustomMCP node configuration path is exposed to unauthenticated callers. The description does not state whether a deployed flow or specific route must be reachable, so that detail is not confirmed.

Exploitation

Not listed in CISA KEV, but EPSS is 0.86218 (99.7th percentile) and the vendor advisory is tagged Exploit, indicating public exploit material exists. No ransomware usage is documented.

What to do

• Upgrade Flowise to 3.0.6 or later, which patches the CustomMCP code injection.
• If immediate upgrade is not possible, restrict network access to the Flowise instance and its node configuration endpoints to trusted users only.
• Disable or remove the CustomMCP node until the patch is applied.
• Run Flowise under a low-privilege account with no access to sensitive files or credentials, and isolate it from production networks.
• Audit existing flows for untrusted mcpServerConfig values and remove any that were not authored by trusted operators.

Detection

• Monitor Flowise process activity for unexpected child_process spawns or shell commands originating from the Node.js runtime.
• Alert on outbound network connections from the Flowise host to unknown MCP or external servers.
• Review Flowise logs and flow definitions for CustomMCP nodes containing suspicious JavaScript in mcpServerConfig.
• Watch for file system writes or reads by the Flowise process in paths outside its normal working directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.