Opening SecureFlowFlowise CustomMCP: Configuration Text Becomes Server Code
Case summary & sources

AIDEFEND SecureFlow / SecureFlow Case Index

SonicWall Capture Labs aidefend-sf0067

Flowise CustomMCP: Configuration Text Becomes Server Code

  • Autonomous Agents
  • System Compromise & RCE

Flowise builds AI workflows and connects external tools through MCP. CVE-2025-59528 lets a reachable CustomMCP configuration handler evaluate supplied text with the Node.js Function constructor. SonicWall reported exploitation in 2026. Flowise 3.0.6 replaced that evaluation with data parsing; a restricted prompt does not repair the server-side configuration boundary.

Mapped threat techniques

  • AML.T0049 Exploit Public-Facing Application
  • AML.T0050 Command and Scripting Interpreter

Source

Updated