CVE-2026-69255: Flowise CSVAgent RCE Vulnerability

CVE-2026-69255 Overview

CVE-2026-69255 is a code injection vulnerability [CWE-94] in Flowise, a drag-and-drop interface for building large language model (LLM) workflows. Versions prior to 3.1.3 expose the CSVAgent component to attacker-controlled CSV payloads. The agent parses uploaded data with file.split(',').pop() and interpolates the result directly into a Python code block executed by Pyodide. An authenticated attacker can break out of the string literal, load Node.js child_process through Pyodide's JavaScript bridge, and execute operating system commands as root inside the Flowise container.

Critical Impact
Authenticated attackers can achieve arbitrary command execution as root within the Flowise container, leading to full application compromise.

Affected Products

FlowiseAI Flowise versions prior to 3.1.3
Component: packages/components/nodes/agents/CSVAgent/CSVAgent.ts
Fixed release: Flowise 3.1.3

Discovery Timeline

2026-08-04 - CVE-2026-69255 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-69255

Vulnerability Analysis

The CSVAgent node in Flowise ingests a CSV file, converts it to base64, and hands the value to a Python runtime powered by Pyodide. Before invoking the LLM, the component builds an initial Python snippet by directly interpolating the base64 string into source code using the template literal base64_string = "${base64String}". Because the value is derived from file.split(',').pop() on attacker-controlled input, it is never sanitized or escaped. The existing validatePythonCodeForDataFrame() denylist only inspects Python code returned by the LLM in later steps, not this initial bootstrap block. As a result, attacker-supplied content is executed verbatim inside Pyodide.

Root Cause

The root cause is unsafe string interpolation of untrusted input into an executable Python program. The validator that blocks dangerous constructs such as import, exec, open, os, and subprocess runs on a different code path and does not cover the bootstrap snippet. Pyodide additionally exposes a JavaScript bridge that lets Python code reach back into the Node.js runtime, which removes the sandbox boundary the design implicitly relied on.

Attack Vector

An authenticated user uploads a crafted CSV whose payload begins with a closing double quote followed by Python statements. When CSVAgent builds the initial snippet, the injected code becomes part of the executed program. The attacker uses Pyodide's js module to import Node.js child_process, then invokes exec or spawn to run shell commands. The commands execute with the privileges of the Flowise process, which typically runs as root inside the container.

See the GitHub Security Advisory GHSA-vmv7-4m6c-3cg5 and the GitHub Pull Request Discussion for full technical details.

The upstream patch removes the vulnerable Pyodide-based agent entirely. The following excerpt from the fix commit shows the deleted LoadPyodide bootstrap and the system prompt that attempted to constrain LLM output:

typescript

-import type { PyodideInterface } from 'pyodide'
-import * as path from 'path'
-import { getUserHome } from '../../../src/utils'
-
-let pyodideInstance: PyodideInterface | undefined
-
-export async function LoadPyodide(): Promise<PyodideInterface> {
-    if (pyodideInstance === undefined) {
-        const { loadPyodide } = await import('pyodide')
-        const obj: any = { packageCacheDir: path.join(getUserHome(), '.flowise', 'pyodideCacheDir') }
-        pyodideInstance = await loadPyodide(obj)
-        await pyodideInstance.loadPackage(['pandas', 'numpy'])
-    }
-
-    return pyodideInstance
-}
-
-export const systemPrompt = `You are working with a pandas dataframe in Python. The name of the dataframe is df.
-...
-Security: Output ONLY pandas/numpy operations on the dataframe (df). Do not use import, exec, eval, open, os, subprocess, or any other system or file operations. The code will be validated and rejected if it contains such constructs.
-...`

Source: GitHub Commit f4e2794

Detection Methods for CVE-2026-69255

Indicators of Compromise

CSV uploads to the CSVAgent node containing an unescaped double-quote character followed by Python keywords such as import, js, or child_process.
Flowise container processes spawning shells (/bin/sh, /bin/bash) or utilities such as curl, wget, nc, or python -c as child processes of the Node.js runtime.
Outbound network connections from the Flowise container to attacker-controlled hosts immediately after CSV agent activity.

Detection Strategies

Inspect Flowise application logs for CSVAgent invocations paired with malformed CSV payloads or Pyodide runtime errors.
Monitor process ancestry on the Flowise host or pod for node processes that fork sh, bash, or arbitrary binaries.
Alert on file writes to sensitive paths (/etc, /root, /usr/local/bin) originating from the Flowise container.

Monitoring Recommendations

Enable audit logging for authenticated Flowise sessions and correlate uploads with subsequent runtime behavior.
Forward container runtime telemetry (process, file, and network events) to a centralized analytics platform for retrospective hunting.
Track egress traffic from the Flowise namespace and alert on unexpected destinations or protocols.

How to Mitigate CVE-2026-69255

Immediate Actions Required

Upgrade Flowise to version 3.1.3 or later, which removes the vulnerable CSVAgent Pyodide path.
Restrict access to the Flowise UI and API using strong authentication and network segmentation until the patch is applied.
Review Flowise audit logs for prior CSVAgent usage and investigate any anomalous command execution.

Patch Information

Flowise 3.1.3 removes the Pyodide-backed CSV and Airtable agents that performed unsafe string interpolation. Review the GitHub Release Notes v3.1.3 and the GitHub Commit Update for the full list of changes.

Workarounds

Disable or remove the CSVAgent node from any Flowise workflows that accept untrusted input.
Run the Flowise container as a non-root user and enforce a read-only root filesystem to limit post-exploitation impact.
Apply egress network policies that block outbound traffic from the Flowise container except to required LLM endpoints.

bash

# Upgrade Flowise to the patched release
docker pull flowiseai/flowise:3.1.3
docker stop flowise && docker rm flowise
docker run -d --name flowise \
  --user 1001:1001 \
  --read-only \
  -p 3000:3000 \
  flowiseai/flowise:3.1.3