{"data":{"id":"89c39f51-7a38-4d92-a46d-d61f02bf3fae","title":"CVE-2025-59528: Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is…","summary":"Flowise version 3.0.5 is vulnerable to remote code execution through its CustomMCP node. The node parses the user-supplied mcpServerConfig string and passes it to the Function() constructor inside convertToValidJSONString, executing it as JavaScript with no security validation. Because this runs with full Node.js runtime privileges, the attacker can reach modules such as child_process and fs.","solution":"Fixed in version 3.0.6.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-59528","publishedAt":"2025-09-22T20:15:39.530Z","cveId":"CVE-2025-59528","cweIds":["CWE-94"],"cvssScore":"10","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["flowise@= 3.0.5 (fixed: 3.0.6)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Flowise remote code execution through CustomMCP node configuration","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.86492,"epssCheckedAt":"2026-11-04T12:08:34.077Z","kevDateAdded":null,"advisoryAliases":["GHSA-3gcm-f6qx-ff7p"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:38.362Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-09-15T11:14:40.720Z","daysToFix":-7,"fixCheckedAt":"2026-10-29T21:43:39.434Z","capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.0.6","matchedVersion":"3.0.6","fixReleasedAt":"2025-09-15T11:14:40.720Z","daysToFix":-7,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:43:39.284Z"}]}}