- Flowise AI platform carried CVSS-10 arbitrary code flaw
- Vulnerability in CustomMCP node exploited in the wild
- Up to 15,000 exposed instances urged to update immediately
Flowise, a popular open source platform for building custom LLM apps and AI agents, carried a maximum-severity vulnerability which allowed threat actors to run arbitrary code and thus, potentially, take over entire systems.
Flowise is a low‑code platform which allows users to visually build AI workflows, chatbots and LLM‑powered applications by dragging and dropping components instead of writing code. Its GitHub project has more than 40,000 stars, and it is reported to power millions of chats and workflows across developers and companies.
In September 2025, it was discovered that version 3.0.5 contained a bug in the CustomMCP node. When users entered configuration data, the software would run it as JavaScript without checks. This let attackers execute any code on the server, including accessing files or running system commands.
Spotted in the wild
The vulnerability was fixed in version 3.0.6 and currently, the latest version is 3.1.1 - however, more than half a year later, security researchers spotted threat actors abusing it in the wild.
Citing Caitlin Condon from vulnerability intelligence firm VulnCheck, BleepingComputer reported the exploitation of the bug was seen in the company’s Canary network.
“Early this morning, VulnCheck's Canary network began detecting first-time exploitation of CVE-2025-59528, a CVSS-10 arbitrary JavaScript code injection vulnerability in Flowise, an open-source AI development platform,” Condon warned.
She said that the attack was limited to a single Starlink IP, but warned that it might soon expand, since there are currently up to 15,000 Flowise instances exposed to the wider internet. At least some of them are, most likely, not updated to the latest versions and, as such, vulnerable.
The best course of action would be to bring all Flowise instances to the newest version and, if possible, remove them from the public internet if it’s not necessary for everyday operations.
