critical·Product Based Web Vulnerabilities·Updated Apr 6, 2026

Flowise - Remote Code Execution

Run This Scanner →

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsdomain, subdomain, ipv4

CostFree

2.2k

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

CVECVE-2025-59528

10.0

CVSScritical

Exploitable remotely over the internet · no authentication required.

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation. Specifically, inside the convertToValidJSONString function, user input is directly passed to the Function() constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as child_process and fs. This issue has been patched in version 3.0.6.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Affected

Flowiseby FlowiseAI

= 3.0.5

Updated Sep 9, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Run This Scanner →Browse All Tools

Flowise - Remote Code Execution

Check your infrastructure.Right now.

Check your infrastructure.
Right now.