Flowise: Remote Code Execution Vulnerability in CSVAgent
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-69256
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 4, 2026
- Source last modified
- October 24, 2026
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/<UUID> to execute commands. This issue is fixed in version 3.1.3.
Description quoted from the NVD record.
Who is affected
Flowise is a drag-and-drop tool for building apps that use AI language models. This flaw affects Flowise versions before 3.1.3. The problem is in the CSV Agent, a building block that lets a workflow work with CSV spreadsheet files. Its safeguards against dangerous code can be bypassed. Any signed-in user who is allowed to create or change a workflow (called a chatflow) can add a CSV Agent with harmful settings, save it, and then run commands on the computer that hosts Flowise. This flaw is rated High.
What to do
- If someone in your organization installed or runs Flowise on its own computers or servers, that person should handle this. If an IT provider or vendor runs it for you, they should handle it.
- Update Flowise to version
3.1.3or later, which fixes this flaw. Any earlier version is affected. - If an IT provider or vendor manages Flowise for your organization, send them this advisory and ask when the update will be done.
- If you are not sure whether your organization uses Flowise, ask the person or company that looks after your computers and online tools.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.