Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12,000+ Instances Exposed
Threat actors are exploiting CVE-2025-59528, a CVSS 10.0 code injection flaw in the open-source Flowise AI platform that lets the CustomMCP node execute JavaScript without security validation, enabling remote code execution with full Node.js runtime...