Cybercriminals are taking advantage of a critical vulnerability, identified as CVE-2025-59528, in Flowise, an open-source platform that allows users to visually create LLM apps and intelligent agent systems. This flaw can be used to run malicious code on the system.

The vulnerability involves injecting JavaScript code without proper security measures. It was publicly disclosed last September, with warnings that successful exploitation could result in executing commands and accessing the file system.

The issue lies within the Flowise CustomMCP node, where configuring settings to connect to an external Model Context Protocol (MCP) server allows for unsafe execution of user-provided mcpServerConfig input. This means that JavaScript can be executed without any prior safety checks.

The developers fixed this in Flowise version 3.0.6. The most recent version is 3.1.1, released two weeks ago.

Flowise is an open-source, low-code platform used to create AI agents and LLM-driven workflows. Through a drag-and-drop interface, users can connect various components to construct pipelines that power chatbots, automate tasks, and build AI systems.

Its user base is diverse and includes AI prototyping developers, non-technical individuals who use no-code tools, and organizations that operate customer support chatbots and knowledge assistants.

Caitlin Condon, a security researcher at VulnCheck, a company focused on vulnerability intelligence, announced on LinkedIn that their Canary network had detected exploitation of CVE-2025-59528.

“This morning, VulnCheck’s Canary system detected initial exploitation attempts targeting CVE-2025-59528, a critical JavaScript code injection vulnerability with a CVSS score of 10, in Flowise, which is an open-source platform for AI development,” Condon said.

While the activity appears to be limited at the moment, originating from a single IP address using Starlink, researchers have pointed out that there are approximately 12,000 to 15,000 Flowise instances accessible online.

It is unknown, however, what percentage of these online instances are susceptible to the vulnerability.

Condon also noted that the activity related to CVE-2025-59528 is occurring in addition to the exploitation of CVE-2025-8943 and CVE-2025-26319, which also impact Flowise and have been observed to be actively exploited.

Currently, VulnCheck is providing exploit samples, network detection rules, and YARA rules exclusively to its clients.

Flowise users are urged to upgrade to version 3.1.1 or at least 3.0.6 immediately. If external access is not required, they should also consider removing their instances from the public internet.