This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Flowise 3.0.5 suffers from **Code Injection** in the `CustomMCP` node. ๐ **Consequences**: Attackers can achieve **Remote Code Execution (RCE)** by injecting malicious JavaScript.โฆ
๐ก๏ธ **Root Cause**: **CWE-94** (Code Injection). The `convertToValidJSONString` function directly passes user input to the JavaScript `Function()` constructor.โฆ
๐ฆ **Affected**: **Flowise** versions **3.0.5** and likely earlier. ๐งฉ **Component**: Specifically the **CustomMCP** node used for connecting to external MCP servers. ๐ข **Vendor**: FlowiseAI.
Q4What can hackers do? (Privileges/Data)
๐ **Privileges**: Attackers gain **full Node.js privileges**. ๐ **Data**: Complete access to the server's file system, environment variables, and network. ๐ **Impact**: Critical (CVSS High) โ total system compromise.
Q5Is exploitation threshold high? (Auth/Config)
๐ **Threshold**: **Low**. ๐ **Access**: Network-accessible (AV:N). ๐ **Auth**: None required (PR:N/UI:N). โ๏ธ **Config**: Exploitation requires the victim to process user input through the vulnerable `CustomMCP` node.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ **Public Exp**: **Yes**. Multiple PoCs are available on GitHub (e.g., `zimshk/CVE-2025-59528.yaml`). ๐ **Automation**: Nuclei templates are also published, making automated exploitation easy for attackers.
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Scan for Flowise instances running version **3.0.5**. ๐งช **Test**: Use the provided YAML PoC to trigger the `Function()` injection via the `CustomMCP` node configuration.โฆ
๐ ๏ธ **Fix**: **Yes**. Version **3.0.6** has been released. ๐ฅ **Action**: Upgrade immediately to **Flowise 3.0.6** or later. ๐ **Patch**: The vendor has addressed the unsafe evaluation in the new release.
Q9What if no patch? (Workaround)
๐ง **Workaround**: If you cannot upgrade, **disable or remove** the `CustomMCP` node entirely. ๐ซ **Restrict**: Do not allow untrusted users to configure MCP server connections.โฆ
๐ฅ **Urgency**: **CRITICAL**. ๐จ **Priority**: **P0**. With public PoCs and low exploitation barriers, immediate patching to v3.0.6 is essential to prevent active exploitation and server takeover.