# CVE-2025-59528: Flowise - RCE

> Live exploitation tracking for CVE-2025-59528 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-59528

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** FlowiseAI Flowise
- **Weaknesses:** CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** ai_mcp, nodejs, web_application

## Description

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation. Specifically, inside the convertToValidJSONString function, user input is directly passed to the Function() constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as child_process and fs. This issue has been patched in version 3.0.6.

## CrowdSec analysis

[CVE-2025-59528](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-59528) is a critical remote code execution vulnerability in Flowise version 3.0.5, stemming from unsafe handling of user input in the CustomMCP node. Attackers can exploit this flaw by supplying malicious JavaScript code, which is executed with full Node.js privileges, potentially granting access to sensitive system resources and enabling arbitrary command execution. This vulnerability poses a severe risk, as it allows unauthenticated attackers to fully compromise affected systems. The issue has been addressed in Flowise version 3.0.6.

CrowdSec has been tracking this vulnerability and its exploits since 17th of June 2026.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2025-59528 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance.
CrowdSec network telemetry also shows that exploitation of CVE-2025-59528 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit the Flowise API endpoint `/api/v1/node-load-method/customMCP` by sending malicious JSON payloads to the `mcpServerConfig` input, enabling remote code execution with Node.js privileges. Initial access is typically gained via authentication to `/api/v1/auth/login`, after which crafted requests are used to trigger the vulnerability.

## Timeline

- 2025-09-22: CVE Published. CVE-2025-59528 is published to NVD.
- 2026-06-17: Rule Released. CrowdSec releases a rule to detect CVE-2025-59528 exploitation attempts against the CrowdSec Network.
- 2026-08-07: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-59528 for the first time.

## References

- https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6
- https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/controllers/nodes/index.ts#L57-L78
- https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L262-L270
- https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/services/nodes/index.ts#L91-L94
- https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/routes/node-load-methods/index.ts#L5
- https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L132
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p
- https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L220
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59528.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-59528) follows observed exploitation activity for CVE-2025-59528. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.