Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection, Root Shell Verified
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-69255
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 4, 2026
- Source last modified
- October 24, 2026
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split(',').pop() and interpolated it directly into executable Python as base64_string = "${base64String}" before calling Pyodide. The validatePythonCodeForDataFrame() denylist only checked later LLM-generated code and did not validate this initial code block. An authenticated attacker could inject a closing quote followed by Python code, use Pyodide's js bridge to load Node.js child_process, and execute arbitrary operating system commands as root in the Flowise container. This issue is fixed in version 3.1.3.
Description quoted from the NVD record.
Who is affected
Your organization is affected if it uses Flowise, a drag-and-drop tool for building apps that use AI language models, at any version before 3.1.3. The problem is in the CSV agent, a building block that lets a workflow read and answer questions about spreadsheet-style data files. Someone who already has a login to your Flowise could hide their own commands inside a data file and make the system run them. They could then run any command on the server with full administrator control inside the Flowise container (the self-contained space it runs in). This flaw is rated High.
What to do
- Find out who runs Flowise for your organization. If someone on your staff or a volunteer installed it, that person should act. If an IT provider or vendor manages it, they should act.
- The person who runs Flowise should update it to version
3.1.3or later, which fixes this flaw. - If an IT provider or vendor runs Flowise for you, send them this advisory and ask when the update will be done.
- No workaround is named for this flaw, so updating is the way to close it. Check the vendor advisory linked on this page for details on the fixed release.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.