Flowise AI platform faces active exploitation of CVSS 10.0 remote code execution vulnerability

Flowise Under Attack Through Maximum-Severity Vulnerability

Threat actors have begun exploiting CVE-2025-59528, a code injection flaw in Flowise that carries a CVSS 10.0 rating, marking it as a maximum-severity vulnerability 1

1

. The open-source AI platform, widely used for building custom LLM applications and AI agent systems, now faces active exploitation that could lead to remote code execution across thousands of installations. VulnCheck's Canary network first detected exploitation attempts early in the morning, with activity originating from a single Starlink IP address 2

2

.

Flowise provides a drag-and-drop interface that enables developers and non-technical users to create AI-powered chatbots, automation workflows, and knowledge-based assistants. The platform's accessibility has made it popular among corporations and individual developers working in AI prototyping 2

2

. However, this widespread adoption now creates significant security risk as attackers scan for vulnerable targets.

Critical Code Injection Flaw Enables Arbitrary Code Execution

The vulnerability resides in Flowise's CustomMCP node, which allows users to input configuration settings for connecting to an external Model Context Protocol server 1

1

. According to Flowise's advisory released in September 2025, the node parses the user-provided mcpServerConfig string to build the MCP server configuration but executes JavaScript code without any security validation during this process.

This design flaw grants attackers access to dangerous modules such as child_process for command execution and fs for file system operations, as the code runs with full Node.js runtime privileges 1

1

. A threat actor who weaponizes this vulnerability can execute arbitrary JavaScript code on the Flowise server, leading to full system compromise, file system access, command execution, and sensitive data exfiltration. As Flowise noted in its advisory, "As only an API token is required, this poses an extreme security risk to business continuity and customer data" 1

1

.

Thousands of Exposed Flowise Instances Create Broad Attack Surface

Between 12,000 and 15,000 exposed Flowise instances are currently accessible online, creating a substantial attack surface for opportunistic threat actors 2

2

. While the exact percentage of vulnerable servers remains unclear, the sheer volume of exposed instances amplifies the threat. Caitlin Condon, vice president of security research at VulnCheck, emphasized the severity: "This is a critical-severity bug in a popular AI platform used by a number of large corporations" 1

1

.

The vulnerability has been public for more than six months, giving defenders time to prioritize and patch the flaw, yet active exploitation continues 1

1

. This represents the third Flowise flaw experiencing in-the-wild exploitation, following CVE-2025-8943, an operating system command remote code execution with a CVSS score of 9.8, and CVE-2025-26319, an arbitrary file upload vulnerability with a CVSS score of 8.9 1

1

2

2

.

Immediate Action Required for Flowise Users

The issue was addressed in Flowise version 3.0.6 of the npm package, with the latest version 3.1.1 released two weeks ago 1

1

2

2

. Kim SooHyun discovered and reported the flaw to Flowise . Users should upgrade to version 3.1.1 or at minimum 3.0.6 immediately to protect against active exploitation. Organizations should also consider removing their instances from the public internet if external access is not essential for operations 2

2

. VulnCheck currently provides exploit samples, network signatures, and YARA rules to its customers to help detect and prevent attacks 2

2

.