Servers and applications
CVE-2025-59528
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it…
- Severity
- Critical 10.0
- Published
- 22 Sept 2025
- Last changed
- 18 Oct 2026
- Added to UpHeron
- 1 Nov 2026
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
FlowiseServers and applications · cpe:a:flowiseai:flowise |
|