This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: Flowise 3.0.5 suffers from **Code Injection** in the `CustomMCP` node. π **Consequences**: Attackers can achieve **Remote Code Execution (RCE)** by injecting malicious JavaScript.β¦
π‘οΈ **Root Cause**: **CWE-94** (Code Injection). The `convertToValidJSONString` function directly passes user input to the JavaScript `Function()` constructor.β¦
π **Privileges**: Attackers gain **full Node.js privileges**. π **Data**: Complete access to the server's file system, environment variables, and network. π **Impact**: Critical (CVSS High) β total system compromise.
Q5Is exploitation threshold high? (Auth/Config)
π **Threshold**: **Low**. π **Access**: Network-accessible (AV:N). π **Auth**: None required (PR:N/UI:N). βοΈ **Config**: Exploitation requires the victim to process user input through the vulnerable `CustomMCP` node.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π **Public Exp**: **Yes**. Multiple PoCs are available on GitHub (e.g., `zimshk/CVE-2025-59528.yaml`). π **Automation**: Nuclei templates are also published, making automated exploitation easy for attackers.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for Flowise instances running version **3.0.5**. π§ͺ **Test**: Use the provided YAML PoC to trigger the `Function()` injection via the `CustomMCP` node configuration.β¦
π οΈ **Fix**: **Yes**. Version **3.0.6** has been released. π₯ **Action**: Upgrade immediately to **Flowise 3.0.6** or later. π **Patch**: The vendor has addressed the unsafe evaluation in the new release.
Q9What if no patch? (Workaround)
π§ **Workaround**: If you cannot upgrade, **disable or remove** the `CustomMCP` node entirely. π« **Restrict**: Do not allow untrusted users to configure MCP server connections.β¦
π₯ **Urgency**: **CRITICAL**. π¨ **Priority**: **P0**. With public PoCs and low exploitation barriers, immediate patching to v3.0.6 is essential to prevent active exploitation and server takeover.