Executive brief
Flowise is a workflow platform for building AI chatbots and automations. A critical vulnerability allows unauthenticated attackers to execute arbitrary code on servers running Flowise by injecting malicious JavaScript into the Custom MCP Chatflow configuration. This leads to complete system compromise, including data theft, service disruption, and potential lateral movement to other systems.
Technical details
The vulnerability exists in the CustomMCP node's convertToValidJSONString function, which uses an unsafe dynamic Function constructor to evaluate user-controlled input (CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code). When a string value is passed to the mcpServerConfig parameter via POST to /api/v1/node-load-method/customMCP, it is concatenated directly into a Function constructor without sanitization, effectively executing arbitrary JavaScript code. Unlike other code execution features in Flowise that use @flowiseai/nodevm sandboxing, this code runs in the unsandboxed host context, giving attackers access to NodeJS global objects and the child_process module. The attack requires no authentication (the header "x-request-from: internal" is not a security control) and no user interaction, enabling direct remote code execution on vulnerable servers.
Affected products
- FlowiseAI Flowise up to and including 2.2.7-patch.1
Timeline
- 2025-10-06: disclosed: Vulnerability published as GHSA-hmgh-466j-fx4c
- 2025-10-03: other: Advisory published by FlowiseAI