10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-3gcm-f6qx-ff7p

GHSA-3gcm-f6qx-ff7p: Flowise has Remote Code Execution vulnerability

Description

Cause of the Vulnerability

The CustomMCP node allows users to input configuration settings for connecting to an external MCP (Model Context Protocol) server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation.

Specifically, inside the convertToValidJSONString function, user input is directly passed to the Function() constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as child_process and fs.

Vulnerability Flow

User Input Received: Input is provided via the API endpoint /api/v1/node-load-method/customMCP through the mcpServerConfig parameter.
Variable Substitution: The substituteVariablesInString function replaces template variables like $vars.xxx, but no security filtering is applied during this step.
Dangerous Code Execution: The convertToValidJSONString function executes the input using Function('return ' + inputString)(). If the inputString contains malicious code, it gets executed in the global Node.js context, allowing actions such as command execution and file system access.

Taint Flow

Taint 01: Route Registration
index.ts (Line 5)
Taint 02: Controller
index.ts (Line 57–78)
Taint 03: Service
index.ts (Line 91–94)
Taint 04: CustomMCP Node Entry Point
CustomMCP.ts (Line 132)
Taint 05: Variable Substitution
CustomMCP.ts (Line 220)
Taint 06: Dangerous Constructor Execution
CustomMCP.ts (Line 262–270)

Proof of Concept (PoC)

curl -X POST http://localhost:3000/api/v1/node-load-method/customMCP \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer tmY1fIjgqZ6-nWUuZ9G7VzDtlsOiSZlDZjFSxZrDd0Q" \
  -d '{
    "loadMethod": "listActions",
    "inputs": {
      "mcpServerConfig": "({x:(function(){const cp = process.mainModule.require(\"child_process\");cp.execSync(\"echo !!RCE-OK!! >/tmp/RCE.txt\");return 1;})()})"
    }
  }'

When executed, this creates a file /tmp/RCE.txt on the server, confirming command execution.

Impact

Complete System Takeover and Infrastructure Threat

This vulnerability allows attackers to execute arbitrary JavaScript code on the Flowise server, leading to:

Full system compromise
File system access
Command execution
Sensitive data exfiltration

As only an API token is required, this poses an extreme security risk to business continuity and customer data.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-3gcm-f6qx-ff7p

GHSA-3gcm-f6qx-ff7p:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
flowise	npm	= 3.0.5	3.0.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Remote Code Execution (RCE) within the CustomMCP component of Flowise, identified as GHSA-3gcm-f6qx-ff7p. The root cause is the unsafe parsing of a user-provided configuration string, mcpServerConfig, using the Function() constructor, which executes the string as JavaScript code.

The analysis of the provided patch, which was identified by comparing the vulnerable version 3.0.5 and the patched version 3.0.6, confirms this. The commit 4af067a444a579f260d99e8c8eb0ae3d5d9b811a replaces the dangerous Function('return ' + inputString)() call with JSON5.parse(inputString) inside the convertToValidJSONString function in packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts.

Based on this, two key functions have been identified:

convertToValidJSONString: This is the primary vulnerable function where the code injection and execution actually happen. It directly uses the Function() constructor on user-controlled data.
CustomMCP_Tools.loadMethods: This method orchestrates the attack. It retrieves the malicious payload from the user input (mcpServerConfig) and passes it down to convertToValidJSONString. As such, it is a critical function that would be observed in any runtime profile or stack trace when the vulnerability is triggered.

The fix correctly addresses the vulnerability by replacing the code execution with a safe JSON parsing method, preventing the RCE.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

10

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-3gcm-f6qx-ff7p: Flowise has Remote Code Execution vulnerability

Description

Cause of the Vulnerability

Vulnerability Flow

Taint Flow

Proof of Concept (PoC)

Impact

Complete System Takeover and Infrastructure Threat

GHSA-3gcm-f6qx-ff7p:

10

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

10

10

GHSA-3gcm-f6qx-ff7p: Flowise has Remote Code Execution vulnerability

Description

Cause of the Vulnerability

Vulnerability Flow

Taint Flow

Proof of Concept (PoC)

Impact

Complete System Takeover and Infrastructure Threat

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI