CVE-2025-59528: Flowise Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3gcm-f6qx-ff7p",
  "modified" : "2025-10-13T15:49:17Z",
  "published" : "2025-09-15T19:59:57Z",
  "aliases" : [ "CVE-2025-59528" ],
  "summary" : "Flowise has Remote Code Execution vulnerability",
  "details" : "## Description\n\n### Cause of the Vulnerability\n\nThe `CustomMCP` node allows users to input configuration settings for connecting to an external MCP (Model Context Protocol) server. This node parses the user-provided `mcpServerConfig` string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation.\n\nSpecifically, inside the `convertToValidJSONString` function, user input is directly passed to the `Function()` constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as `child_process` and `fs`.\n\n### Vulnerability Flow\n\n1. **User Input Received**: Input is provided via the API endpoint `/api/v1/node-load-method/customMCP` through the `mcpServerConfig` parameter.\n2. **Variable Substitution**: The `substituteVariablesInString` function replaces template variables like `$vars.xxx`, but no security filtering is applied during this step.\n3. **Dangerous Code Execution**: The `convertToValidJSONString` function executes the input using `Function('return ' + inputString)()`. If the `inputString` contains malicious code, it gets executed in the global Node.js context, allowing actions such as command execution and file system access.\n\n## Taint Flow\n\n- **Taint 01: Route Registration**  \n  [`index.ts` (Line 5)](https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/routes/node-load-methods/index.ts#L5)\n\n- **Taint 02: Controller**  \n  [`index.ts` (Line 57–78)](https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/controllers/nodes/index.ts#L57-L78)\n\n- **Taint 03: Service**  \n  [`index.ts` (Line 91–94)](https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/services/nodes/index.ts#L91-L94)\n\n- **Taint 04: CustomMCP Node Entry Point**  \n  [`CustomMCP.ts` (Line 132)](https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L132)\n\n- **Taint 05: Variable Substitution**  \n  [`CustomMCP.ts` (Line 220)](https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L220)\n\n- **Taint 06: Dangerous Constructor Execution**  \n  [`CustomMCP.ts` (Line 262–270)](https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L262-L270)\n\n## Proof of Concept (PoC)\n\n```bash\ncurl -X POST http://localhost:3000/api/v1/node-load-method/customMCP \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Authorization: Bearer tmY1fIjgqZ6-nWUuZ9G7VzDtlsOiSZlDZjFSxZrDd0Q\" \\\n  -d '{\n    \"loadMethod\": \"listActions\",\n    \"inputs\": {\n      \"mcpServerConfig\": \"({x:(function(){const cp = process.mainModule.require(\\\"child_process\\\");cp.execSync(\\\"echo !!RCE-OK!! >/tmp/RCE.txt\\\");return 1;})()})\"\n    }\n  }'\n```\n<img width=\"1907\" height=\"958\" alt=\"image\" src=\"https://github.com/user-attachments/assets/78b50eb1-67af-4c8b-97ea-7e2c05426962\" />\n\nWhen executed, this creates a file `/tmp/RCE.txt` on the server, confirming command execution.\n\n## Impact\n\n### Complete System Takeover and Infrastructure Threat\n\nThis vulnerability allows attackers to execute arbitrary JavaScript code on the Flowise server, leading to:\n\n- Full system compromise\n- File system access\n- Command execution\n- Sensitive data exfiltration\n\nAs only an API token is required, this poses an extreme security risk to business continuity and customer data.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "flowise"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.5"
      }, {
        "fixed" : "3.0.6"
      } ]
    } ],
    "versions" : [ "3.0.5" ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-59528"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/FlowiseAI/Flowise"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L132"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L220"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L262-L270"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/controllers/nodes/index.ts#L57-L78"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/routes/node-load-methods/index.ts#L5"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/services/nodes/index.ts#L91-L94"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-94" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-09-15T19:59:57Z",
    "nvd_published_at" : "2025-09-22T20:15:39Z"
  }
}