release: v1.1.6 — sc_flowise_js_rce (Flowise CVE-2025-59528, CVSS 10.0)

[killertcell428]

Summary

• Salvages sc_flowise_js_rce from closed PR #62 and ships it as v1.1.6.
• PR Claude/eloquent davinci s bng g #62 was closed because it raced PR #61 for the v1.1.5 slot and lost on the merge order — the underlying Flowise CVE-2025-59528 detector is unrelated to that race.
• One new detector, 14 new tests (10 true positives, 4 true negatives), all passing.

What changed

1 new supply-chain detector (aigis/filters/patterns.py)

sc_flowise_js_rce — JavaScript Function() Constructor / eval() in MCP Configuration (score 85)

Flowise CVE-2025-59528 (CVSS 10.0, exploited April 2026). The Flowise CustomMCP node parsed user-supplied mcpServerConfig JSON and executed it via JavaScript's Function() constructor — functionally identical to eval() — with no validation. A single payload achieves host-level RCE on the Flowise server, exposing every LLM API key, database credential, and OS resource reachable by the application. 12,000–15,000 instances remained unpatched when exploitation began, more than six months after Flowise 3.1.1 shipped the fix.

The pattern catches:

• new Function(...) with child_process / fs / os / net / http / https / process.env / execSync / spawnSync / .exec( references
• Function.prototype.constructor(...) — prototype-chain bypass for naive eval-string blocklists
• eval(...) / new Function(...) / require('child_process'...) appearing inside MCP mcpServerConfig / "command": / "args": fields

Example blocked input:

new Function('return require("child_process").execSync("id")')()
mcpServerConfig: "new Function(code)()"
"command": "require('child_process').exec('rm -rf /tmp/*')"

Example benign (not blocked):

The Function() constructor is a JavaScript built-in that creates function objects.
The fix replaced Function() with JSON5.parse() to safely parse config.
new Function('x', 'return x + 1')(5)

Provenance

Detector source: origin/claude/eloquent-davinci-sBngG (the PR #62 branch) verbatim. Only release-metadata changed: version bumped 1.1.5 → 1.1.6, CHANGELOG section moved out of v1.1.5 and into v1.1.6. auto-improvement/INDEX.md and ROTATION.md are intentionally not touched — this is not a new rotation cycle, it is a follow-up to cycle 9.

Test plan

• uv run --no-sync pytest --tb=no -q → 1582 passed · 0 failed · 0 skipped (measured 2026-05-18 on this branch)
• uv run --no-sync ruff check aigis/filters/patterns.py tests/test_incident_postmortems3.py → All checks passed
• 10 true-positive tests covering: Function() + each of child_process / execSync / spawnSync / fs / process.env / net; Function.prototype.constructor prototype-chain bypass; mcpServerConfig with eval() and new Function(); "command": with child_process
• 4 true-negative tests covering: prose discussion of Function(); mention of JSON5.parse() fix; safe new Function('x', 'return x + 1')(5) arithmetic use; prose mention of require('child_process')

🤖 Generated with Claude Code