In the wild
Realized harm
CVE-2025-59528: CVSS 10.0 code injection in Flowise CustomMCP node, exploited in the wild
AIR-2025-0132 AIR record · 2025-09-flowiseai-custommcp-rce
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
user input is directly passed to the `Function()` constructor, which evaluates and executes the input as JavaScript code.github.com
The record
Disclosed
2025-09-13
Occurred
2026-04-07
Vendor
FlowiseAI
Product
FlowiseAI Flowise
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
AI was the target — CVSS 10.0 code injection in a Flowise node, exploited in the wild
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Api request to custommcp node config
Impact type
Remote code execution, Full host compromise
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
12,000-15,000 Flowise instances exposed on the public internet at the time exploitation began
Capability abused
Defense & remediation
Recorded defense
API token required; no validation of mcpServerConfig content
Guardrail kinds
Authentication
Guardrail outcome
Silent
Fix shipped
Flowise 3.0.6
Taxonomy & references
Curator notes
Advisory GHSA-3gcm-f6qx-ff7p, CVSS 10.0, published 2025-09-13. VulnCheck's Canary network detected first in-the-wild exploitation on 2026-04-07 from a single Starlink IP - hence class in_the_wild and impact_realized true (real instances hit). Flowise also had CVE-2025-8943 and CVE-2025-26319 under active exploitation. Separate later Flowise RCEs: CVE-2026-41265 (Airtable_Agent code injection) and CVE-2026-40933 (MCP stdio, part of the OX cluster).
Supporting sources
Cite as
Enkrypt AI. "CVE-2025-59528: CVSS 10.0 code injection in Flowise CustomMCP node, exploited in the wild". AIR, AIR-2025-0132. https://agentincident.vercel.app/i/AIR-2025-0132/ (accessed 2026-10-19).