ExploitPublished 31 Oct 2025

Flowise 3.0.4 · Remote Code Execution (RCE)

Source Exploit-DB RSS Feed

Severity

Critical

Rated by Threat Radar

Data as of 30 Dec 2025, 22:16 UTC

What to do

AI-suggested

Immediate mitigation steps include isolating Flowise instances from public internet exposure and restricting access to trusted networks only. Organizations should implement strict input validation and web application firewalls (WAFs) to detect and block suspicious payloads targeting Flowise endpoints. Monitoring network traffic and logs for unusual activity related to Flowise is critical. Until an official patch is released, consider disabling or limiting features that accept external input or executing workflows remotely. Employ network segmentation to contain potential breaches. Regularly back up AI workflow configurations and data to enable recovery in case of compromise. Engage with Flowise developers or community to obtain updates or patches as soon as they become available. Additionally, conduct penetration testing focused on Flowise to identify and remediate other potential weaknesses.

Description

Flowise 3.0.4 - Remote Code Execution (RCE)

Impact

For European organizations, exploitation of this RCE vulnerability in Flowise 3.0.4 could lead to unauthorized access to sensitive AI workflows and data, disruption of AI-driven business processes, and potential lateral movement within internal networks. Confidential data processed or stored by Flowise could be exfiltrated or manipulated, undermining data integrity and compliance with regulations such as GDPR. The availability of AI services may be compromised, affecting operational continuity. Given the increasing adoption of AI tools in sectors like finance, healthcare, and manufacturing across Europe, the impact could be significant. Attackers could leverage this vulnerability to deploy ransomware, steal intellectual property, or conduct espionage. The presence of exploit code lowers the barrier for attackers, increasing the likelihood of targeted attacks against European entities using Flowise.

Indicators of compromise

Exploit source code

Exploit code for Flowise 3.0.4 - Remote Code Execution (RCE)2,890 characters

# Exploit Title: Flowise 3.0.4 - Remote Code Execution (RCE)
# Date: 10/11/2025
# Exploit Author: [nltt0] (https://github.com/nltt-br))
# Vendor Homepage: https://flowiseai.com/
# Software Link: https://github.com/FlowiseAI/Flowise
# Version: < 3.0.5
# CVE: CVE-2025-59528

from requests import post, session
from argparse import ArgumentParser

banner = r"""
_____       _                              _____ 
/  __ \     | |                            /  ___|
| /  \/ __ _| | __ _ _ __   __ _  ___  …

References

Community reviews

Loading reviews…