How the attack works
An attacker sends a chat message crafted to be interpolated into the System Message template field of a Flowise chatflow. Because Flowise renders {{$flow.variables}} and {{$input}} without sanitization, the attacker's text replaces or extends the intended system prompt. This lets the attacker change the chatflow's tool-calling behavior, and public proof-of-concept exploits have chained this into remote code execution by reaching a vm.runInNewContext or new Function sink from the polluted System Message. Twenty-one advisories cover specific affected chatflow templates, including Airtable Agent, CSV Agent, and Parameter Override.
Why it matters
An attacker who controls chat input can hijack a Flowise agent's behavior and tool permissions, and in demonstrated cases escalate this to running arbitrary code on the server hosting the chatflow.
What you can do
- Update Flowise to a patched version that addresses CVE-2025-59528.
- Audit chatflows for System Message fields that interpolate {{$flow.variables}} or {{$input}} and remove or sanitize that usage.
- Treat all chat input as untrusted; do not let it flow unsanitized into prompt templates, code evaluation, or configuration fields.
- Review chatflow templates like Airtable Agent, CSV Agent, and Parameter Override for exposure, since these are named in the published advisories.
Known benign look-alikes
- Flowise documentation or tutorials demonstrating {{$flow.variables}} syntax in educational context.
- Security research tooling that scans for Flowise CVE payloads as reference samples.
- Legitimate Flowise chatflow config files that use {{$flow.variables}} in non-System-Message fields with proper sanitization applied upstream.