CVE-2025-59528 Vulnerability Analysis and Remediation Guidance

This technical report provides an analysis of CVE-2025-59528, a critical unauthenticated remote code execution vulnerability in the Flowise AI agent builder platform. It outlines the vulnerability's root cause, which stems from the use of JavaScript's Function() constructor to process attacker-controlled input, allowing unauthorized access to sensitive credentials and systems. The report details the implications of this vulnerability, particularly following Flowise's acquisition by Workday, highlighting the potential risks to enterprise HR and finance systems. Organizations are advised to upgrade to Flowise version 3.0.6 immediately and to treat any previously exposed instances as compromised. The report also discusses the broader context of security vulnerabilities in Flowise, noting that CVE-2025-59528 is part of a pattern of systemic vulnerabilities identified within the platform, emphasizing the need for ongoing security vigilance. The document serves as a critical resource for organizations utilizing Flowise in their AI infrastructure.