Threat actors have started to exploit a critical vulnerability in Flowise that allows them to execute arbitrary code remotely, VulnCheck warns.
Flowise is an open source development platform that allows users to build customized LLM flows and autonomous agents using a drag-and-drop interface.
Tracked as CVE-2025-59528 (CVSS score of 10), the bug exists because user-supplied JavaScript code is not validated in a function that supports configuration settings input for connecting to an external MCP.
The user-supplied input used to build the MCP server configuration is passed directly to a function that evaluates and executes it as JavaScript code, with full Node.js runtime privileges, leading to remote code execution and access to the file system.
Successful exploitation of the bug could allow attackers to take control of a vulnerable system and exfiltrate sensitive information.
“As only an API token is required, this poses an extreme security risk to business continuity and customer data,” Flowise notes in its advisory.
The security defect affects Flowise versions up to 3.0.5 and was patched in version 3.0.6, which was released in September 2025.
Now, vulnerability intelligence firm VulnCheck says it has observed the first in-the-wild exploitation attempts targeting CVE-2025-59528, suggesting that attackers are taking an interest in vulnerable deployments.
“This is a critical-severity bug in a popular AI platform used by a number of large corporations. This specific vulnerability has been public for more than six months, which means defenders have had time to prioritize and patch the vulnerability,” said VulnCheck VP of security research Caitlin Condon.
The company says it has observed between 12,000 and 15,000 publicly accessible Flowise instances. However, it is unclear how many are running vulnerable versions of the platform.
“The internet-facing attack surface area of 12,000+ exposed instances makes the active scanning and exploitation attempts we’re seeing more serious, as it means attackers have plenty of targets to opportunistically reconnoiter and exploit,” Condon said.
Related: Fortinet Rushes Emergency Fixes for Exploited Zero-Day
Related: GrafanaGhost: Attackers Can Abuse Grafana to Leak Enterprise Data
Related: GPUBreach: Root Shell Access Achieved via GPU Rowhammer Attack
Related: Google DeepMind Researchers Map Web Attacks Against AI Agents
