Security Digest · Vulnerability record
CVE-2025-55346: Flowise vulnerable to RCE via Dynamic function constructor injection
User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request.
CVSS 9.8 Critical EPSS 22.4% · p98
Should you act?
High exploit likelihood
EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 22.4%, percentile 98: FIRST’s model estimates a 22.4% chance of exploitation activity in the next 30 days, higher than 98% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes
flowise(npm) <= 2.2.7-patch.1, no fixed version listed. Check your lockfile, including transitive dependencies.
What it is
User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request.
From the GitHub advisory
Summary User-controlled input flows to an unsafe implementaion of a dynamic Function constructor , allowing a malicious actor to run JS code in the context of the host (not sandboxed) leading to RCE.
Details When creating a new Custom MCP Chatflow in the platform, the MCP Server Config displays a placeholder hinting at an example of the expected input structure:
Behind the scene, a POST request to /api/v1/node-load-method/customMCP is sent with the provided MCP Server Config, with additional parameters (excluded for brevity):
Sending the same request with the parameter mcpServerConfig equals to a plain value and not an object, for example:
We enter an interesting code flow that leads to a function named convertValidJSONString (Line 103): https://github.com/FlowiseAI/Flowise/blob/416e57380ea7ce2e66f89aded61b249ff3eef3b2/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L103
Weakness type: CWE-94, CWE-95, CWE-627.
Product: flowise (npm) · Assigned by: JFROG · Published: 2025-08-14
Affected and fixed versions
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| npm | flowise | <= 2.2.7-patch.1 | none listed |
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| flowise | 0 |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| JFROG | 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- Attack vector: network (remotely reachable)
- Attack complexity: low
- Privileges required: none (no login)
- User interaction: none
- Scope: unchanged
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc, automatable yes, technical impact total.
- FIRST EPSS (model of 2026-10-21): 22.37% probability of exploitation activity in the next 30 days; percentile 98.
Timeline
- — CVE record last updated
- — CVE record published by JFROG
- — GitHub-reviewed advisory GHSA-hmgh-466j-fx4c published (critical)
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vulnerability records
- GitHub Advisory GHSA-hmgh-466j-fx4c github.com
- CVE.org record CVE-2025-55346 cve.org
- NVD entry CVE-2025-55346 nvd.nist.gov
Other references from the CVE record and advisory
- research.jfrog.com research.jfrog.com
- github.com github.com