# Flowise System Message Override via Template Interpolation (CVE-2025-59528)

- **Severity:** Critical
- **Signature ID:** `98d06668-2d78-4e99-93f2-a4fc64698f13`
- **CVEs:** CVE-2025-59528
- **MITRE ATLAS:** AML.T0040 (AI Model Inference API Access), AML.T0051.001 (Indirect)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI05 (Cascading Failures in Multi-Agent Systems), LLM01 (Prompt Injection), LLM05 (Improper Output Handling)

## Summary

Flowise lets chatflow builders insert variables like {{$flow.variables.X}} or {{$input}} directly into a bot's System Message. Because that text isn't sanitized, an attacker can type chat input that overwrites the System Message itself, changing what the bot is told to do and what tools it's allowed to use.

## How the attack works

An attacker sends a chat message crafted to be interpolated into the System Message template field of a Flowise chatflow. Because Flowise renders {{$flow.variables}} and {{$input}} without sanitization, the attacker's text replaces or extends the intended system prompt. This lets the attacker change the chatflow's tool-calling behavior, and public proof-of-concept exploits have chained this into remote code execution by reaching a vm.runInNewContext or new Function sink from the polluted System Message. Twenty-one advisories cover specific affected chatflow templates, including Airtable Agent, CSV Agent, and Parameter Override.

## Why it matters

An attacker who controls chat input can hijack a Flowise agent's behavior and tool permissions, and in demonstrated cases escalate this to running arbitrary code on the server hosting the chatflow.

## What you can do

- Update Flowise to a patched version that addresses CVE-2025-59528.
- Audit chatflows for System Message fields that interpolate {{$flow.variables}} or {{$input}} and remove or sanitize that usage.
- Treat all chat input as untrusted; do not let it flow unsanitized into prompt templates, code evaluation, or configuration fields.
- Review chatflow templates like Airtable Agent, CSV Agent, and Parameter Override for exposure, since these are named in the published advisories.

## Known benign look-alikes

- Flowise documentation or tutorials demonstrating {{$flow.variables}} syntax in educational context.
- Security research tooling that scans for Flowise CVE payloads as reference samples.
- Legitimate Flowise chatflow config files that use {{$flow.variables}} in non-System-Message fields with proper sanitization applied upstream.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00210
- https://nvd.nist.gov/vuln/detail/CVE-2025-59528

---
Source: https://www.netzilo.com/threats/atr-flowise-system-message-override-via-template-interpolation-c