Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-59528 — Go Proof of Concept (PoC) exploit for Flowise CustomMCP Remote Code Execution (RCE) CVE-2025-59528 | Kitploit
Tools/GitHubGitHub/moon-harvest/cve-2025-59528
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRemote Access ToolPayload Development
GitHubmoon-harvest/cve-2025-59528

CVE-2025-59528

Go Proof of Concept (PoC) exploit for Flowise CustomMCP Remote Code Execution (RCE) CVE-2025-59528

View Repository
2 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-59528: Flowise CustomMCP Remote Code Execution PoC

A Go proof of concept for CVE-2025-59528 targeting Flowise versions <= 3.0.5.

Summary

Flowise allows unvalidated JavaScript execution via the CustomMCP node configuration. The application passes user-supplied input inside the mcpServerConfig parameter straight into a Function() constructor within the backend convertToValidJSONString function. This evaluates code with full Node.js privileges, allowing arbitrary system command execution via child_process.

  • Impact: Unauthenticated Remote Code Execution (RCE)
  • Patched Version: 3.0.6

Usage

root@kitploit:~
git clone https://github.com/Moon-Harvest/CVE-2025-59528
cd CVE-2025-59528/
go run main.go <target-base-url> <api-key> <command>

Example

root@kitploit:~
go run main.go http://target.com h3D_9jD7Xzi0V2KSrld9ff4P3rm6cuNXg1uA-wFsUYc "touch /tmp/pwned"
Download Tool