Agent builder exploited in the wild through unsafe evaluation of MCP server configuration

Flowise is a visual builder for LLM applications and agents. Its CustomMCP node accepts a configuration string describing an external MCP server to connect to. While converting that string into usable configuration, the code passed it directly to JavaScript's Function() constructor, which evaluates its argument as code. Anything supplied through the relevant API endpoint ran on the server with full Node.js privileges, including access to process and filesystem modules.

The flaw was assigned CVE-2025-59528, scored 10.0, and disclosed in September 2025, with a fix in version 3.0.6. Exploitation in the wild was reported in April 2026, more than six months later, with scanning and exploitation attempts traced to a single source and more than 12,000 internet-facing instances exposed at the time. No specific compromise or named victim has been publicly confirmed; what is documented is a real adversary actively exploiting a real vulnerability in production deployments, not a demonstration.

This entry is included because that exploitation is real, and it is recorded as no because nothing in the action layer touches it. It is worth stating plainly what the failure was: an agent framework executed attacker-supplied text as code. That is a conventional software defect of a kind that predates agents entirely, and no amount of governing what an agent is permitted to do addresses it. Deployments that were patched, or that were not exposed to the internet, were not affected.