A critical security flaw in Flowise, a popular open-source AI development platform, is currently being exploited in the wild.
Tracked as CVE-2025-59528, this code injection vulnerability carries a maximum CVSS score of 10.0.
It allows remote attackers to execute malicious code and take complete control of affected servers.
Security researchers warn that up to 15,000 Flowise instances remain exposed on the public internet, creating a highly dangerous situation for organizations using the platform.
How the Code Injection Happens
The root cause of this vulnerability lies in how Flowise handles external server configurations. Specifically, the flaw exists within the platform’s CustomMCP (Model Context Protocol) node.
When a user inputs configuration settings to connect to an external server, the application processes this data through a specific function to build the final setup.
Unfortunately, the application evaluates this user-provided text as JavaScript code without applying any security filters.
The system takes the input and passes it directly into a Node.js Function() constructor.
Because this execution happens with full runtime privileges, an attacker can easily write malicious commands that access critical system modules like the file system and child processes.
The attack requires very little effort to execute. An attacker only needs to send a specially crafted network request to the vulnerable API endpoint.
Once the server processes the malicious configuration string, it executes the payload in the background, granting the attacker full remote code execution.
In a proof-of-concept demonstration, researchers showed how a single web request could force the server to execute arbitrary shell commands and create unauthorised files on the system.
Active Threats and Real-World Impact
The cybersecurity firm VulnCheck recently detected the first instances of live exploitation targeting this exact flaw.
According to their early warning network, the initial wave of attacks originated from a single Starlink IP address.
If successfully exploited, this code injection vulnerability leads to catastrophic consequences:
- Full compromise of the underlying host system
- Unauthorized read and write access to the file system
- Silent execution of dangerous system-level commands
- Exfiltration of sensitive business and customer data
This is not the first time threat actors have targeted this platform. Other severe Flowise vulnerabilities, such as CVE-2025-8943 and CVE-2025-26319, have also seen active exploitation in recent months.
The vulnerability impacts Flowise versions 3.0.5 and earlier. The development team has officially addressed the issue by releasing a patched version.
Security teams and network administrators must immediately upgrade their Flowise deployments to version 3.0.6 to secure their infrastructure.
Leaving these instances exposed without the patch practically guarantees a system breach, given the active scanning and exploitation currently taking place.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
