Flowise has Remote Code Execution vulnerability

Summary

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation. Specifically, inside the convertToValidJSONString function, user input is directly passed to the Function() constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as child_process and fs. This issue has been patched in version 3.0.6.

Timeline

1. Sep 22, 2025, 7:54 PM UTCCVE published
2. Sep 22, 2025, 8:23 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: yes · Technical impact: total

3. Sep 22, 2025, 8:24 PM UTCRecord last updated
4. Oct 31, 2025Public exploit on Exploit-DB

   EDB-52440

5. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• FlowiseAI Flowise

  3.0.5

• flowisenpm

  From 3.0.5 · fixed in 3.0.6

References 24