Flowise version 3.0.5 contains a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript with full system privileges.

The vulnerability exists within the CustomMCP node, where the mcpServerConfig string is processed by the convertToValidJSONString function. This function insecurely passes user input directly into a JavaScript Function constructor, resulting in arbitrary code execution with the full privileges of the Node.js runtime.

This vulnerability carries a CVSS score of 10.0, representing the highest level of severity. An unauthenticated attacker can achieve complete system compromise, leading to unauthorized data exfiltration, the installation of persistent backdoors, or the total destruction of the host environment. Given the nature of Flowise as a tool for managing large language model flows, successful exploitation could also result in the compromise of sensitive model data and integrated API credentials.

Immediate Action: Update Flowise to version 3.0.6 or later immediately to apply the necessary input validation fixes.

Proactive Monitoring: Review system and application logs for unexpected process execution, particularly those involving child processes or unauthorized access to the filesystem.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block suspicious JavaScript payloads in HTTP requests, though this should be considered a temporary measure pending a full update.

Public Exploit Available: Yes, a public exploit is available via a Metasploit module and an ExploitDB entry.

Due to the critical nature of this vulnerability and the availability of weaponized exploit code, organizations must prioritize patching Flowise to version 3.0.6. Failure to update immediately exposes the underlying infrastructure to complete takeover. If immediate patching is not feasible, the application should be isolated from public network access until the remediation is successfully deployed and verified.