CVE-2025-59528

{"id": "CVE-2025-59528", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59528", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-22T20:23:40.363660Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "FlowiseAI", "product": "Flowise", "versions": [{"status": "affected", "version": "= 3.0.5"}]}]}], "published": "2025-09-22T20:15:39.530", "references": [{"url": "https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L132", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L220", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L262-L270", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/controllers/nodes/index.ts#L57-L78", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/routes/node-load-methods/index.ts#L5", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/services/nodes/index.ts#L91-L94", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation. Specifically, inside the convertToValidJSONString function, user input is directly passed to the Function() constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as child_process and fs. This issue has been patched in version 3.0.6."}, {"lang": "es", "value": "Flowise es una interfaz de usuario de arrastrar y soltar para construir un flujo personalizado de modelo de lenguaje grande. En la versi\u00f3n 3.0.5, Flowise es vulnerable a ejecuci\u00f3n remota de c\u00f3digo. El nodo CustomMCP permite a los usuarios introducir configuraciones para conectarse a un servidor MCP externo. Este nodo analiza la cadena mcpServerConfig proporcionada por el usuario para construir la configuraci\u00f3n del servidor MCP. Sin embargo, durante este proceso, ejecuta c\u00f3digo JavaScript sin ninguna validaci\u00f3n de seguridad. Espec\u00edficamente, dentro de la funci\u00f3n convertToValidJSONString, la entrada del usuario se pasa directamente al constructor Function(), que eval\u00faa y ejecuta la entrada como c\u00f3digo JavaScript. Dado que esto se ejecuta con privilegios completos de tiempo de ejecuci\u00f3n de Node.js, puede acceder a m\u00f3dulos peligrosos como child_process y fs. Este problema ha sido parcheado en la versi\u00f3n 3.0.6."}], "lastModified": "2026-10-18T21:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flowiseai:flowise:3.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5D151AD-7484-4BE3-B42F-7D0279B5E886"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}