Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Critical, CVSS 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-69264
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 4, 2026
- Source last modified
- October 24, 2026
Description
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import, the attacker can break out of the Python string literal, hand a JavaScript string to js.eval, dynamically import Node built-in modules such as fs and child_process, and execute arbitrary file I/O or OS commands as the Flowise process. The two validator paths around this code, validatePythonCodeForDataFrame and validateCustomReadCSVFunction, are never applied to the bootstrap template. A workspace user with chatflows:create or agentflows/chatflows update permission can plant a CSV Agent node with a crafted csvFile; once the chatflow is exposed via POST /api/v1/prediction/:id, any unauthenticated request triggers host remote code execution. This issue is fixed in version 3.1.3.
Description quoted from the NVD record.
Who is affected
This problem affects Flowise, a tool for building apps that use AI language models, in versions before 3.1.3. The flaw is in the CSV Agent, a building block that lets a chatflow work with spreadsheet data in CSV files. A workspace user who is allowed to create or edit chatflows can add a CSV Agent with a specially crafted file. Once that chatflow is opened up for use, anyone can send it a request without logging in and run commands or read and change files on the computer running Flowise. This flaw is rated Critical.
What to do
- Find out who installed and runs Flowise for your organization. If it is you or someone on your team, that person should act on this flaw.
- Update Flowise to version
3.1.3or later, which fixes this flaw. - If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update will be done.
- For more detail on the fix, check the vendor advisory linked on this page.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.