by Kastro
Paper/Archive/CVE-2025-55346

CVE-2025-55346

JFROG — Unintended dynamic code execution leads to remote code execution by network attackers

EPSS 23%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 97.7.977 × 2019.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request.

Affected

ProductAffectedFixed inSource
flowiseall versions–CNA

Scores by source

JFROG (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitresearch.jfrog.com/vulnerabilities/flowise-js-injection-remote-code-exection-jfsa-2025-001379925