Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Critical, CVSS 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-70477
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 4, 2026
- Source last modified
- October 24, 2026
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist validator and executes in an unsandboxed Pyodide environment. The specific flaw exists within the run method of the CSV_Agents class, where untrusted data is used to construct an LLM prompt and the resulting pythonCode is validated by validatePythonCodeForDataFrame before execution. An attacker can leverage this to execute arbitrary code in the context of the service account. This issue is fixed in 3.1.3.
Description quoted from the NVD record.
Who is affected
Flowise is a drag-and-drop tool for building apps that use AI language models. This flaw affects versions before 3.1.3, in chatflows (the chat workflows you build in Flowise) that use the CSV Agent building block, which lets the AI work with spreadsheet-style CSV files. An attacker can send specially worded messages to such a chatflow that trick the AI into replying with a harmful program. That program slips past Flowise's safety check and runs without being walled off. The attacker can then run any commands they like with the same access as the account Flowise runs under. This flaw is rated Critical.
What to do
- Find out who installed or looks after Flowise for your organization, whether a staff member, a volunteer or an outside IT provider. That person should handle this flaw.
- Ask them to check which version of Flowise your organization runs. Any version before
3.1.3has this flaw. - Update Flowise to version
3.1.3or later, which fixes this flaw. - If an IT provider or vendor runs Flowise for you, send them this advisory and ask when the update to
3.1.3will be done.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.