CVE-2026-69256: Flowise CSVAgent RCE Vulnerability

CVE-2026-69256 Overview

CVE-2026-69256 is a code injection vulnerability [CWE-94] in Flowise, a drag-and-drop interface for building large language model workflows. The flaw affects versions prior to 3.1.3 in the CSVAgent node, which executes user-supplied Python code through Pyodide. A denylist attempted to block dangerous constructs, but pandas.read_pickle() bypassed the filter and deserialized attacker-controlled pickled payloads. An authenticated user who can create or modify a chatflow can achieve remote code execution on the Flowise server. The maintainers released a fix in version 3.1.3.

Critical Impact
Authenticated attackers with chatflow edit permissions can execute arbitrary commands on the Flowise host by placing a malicious read_pickle payload in the CSV Agent's Additional Parameters.

Affected Products

Flowise versions prior to 3.1.3
flowise-components/nodes/agents/CSVAgent/CSVAgent.ts component
Flowise deployments exposing /api/v1/prediction/<UUID> endpoints

Discovery Timeline

2026-08-04 - CVE-2026-69256 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-69256

Vulnerability Analysis

The CSVAgent node in Flowise accepts a customReadCSVFunc parameter that is concatenated into a Python expression as pd.${customReadCSVFunc} and executed inside Pyodide. The project attempted to sandbox this execution with a denylist blocking constructs such as import, exec, and eval. The denylist did not include read_pickle, a pandas function that deserializes a Python pickle stream. Pickle deserialization is a well-known code-execution primitive because __reduce__ methods on pickled objects run arbitrary callables during unpickling. An authenticated user with chatflow write access can invoke read_pickle against a URL or path they control and execute commands in the Flowise process context.

Root Cause

The root cause is reliance on a denylist to validate untrusted Python code before handing it to pyodide.runPythonAsync(). The denylist enumerated dangerous keywords but did not account for functions that internally trigger deserialization. Because pickle payloads execute arbitrary Python during load, any pandas API surface that reads pickle data is equivalent to exec() for the attacker.

Attack Vector

Exploitation requires an authenticated account that can create or modify a chatflow. The attacker adds a CSV Agent node, sets the customReadCSVFunc field to a read_pickle call referencing a hosted malicious pickle, saves the chatflow, and issues a request to /api/v1/prediction/<UUID>. The prediction endpoint drives the agent, which evaluates the crafted expression and deserializes the payload, running attacker code on the server.

typescript

// Patch excerpt: packages/components/nodes/agents/CSVAgent/CSVAgent.ts
 import { ICommonObject, INode, INodeData, INodeParams, IServerSideEventStreamer, PromptTemplate } from '../../../src/Interface'
 import { getBaseClasses } from '../../../src/utils'
 import { LoadPyodide, finalSystemPrompt, systemPrompt } from './core'
-import { validatePythonCodeForDataFrame } from '../../../src/pythonCodeValidator'
+import { validatePythonCodeForDataFrame, validateCustomReadCSVFunction } from '../../../src/pythonCodeValidator'
 import { checkInputs, Moderation } from '../../moderation/Moderation'
 import { formatResponse } from '../../outputparsers/OutputParserHelpers'
 import { getFileFromStorage } from '../../../src'
// Source: https://github.com/FlowiseAI/Flowise/commit/c79fe56a6c249850e96bce9b4859f7a0083e4507

The fix introduces validateCustomReadCSVFunction, an allowlist that permits only a bare read_csv(...) call in the custom CSV field, and blocks read_pickle and class definitions in the DataFrame validator. See the Flowise Security Advisory GHSA-x6vm-w76m-8j7g for full details.

Detection Methods for CVE-2026-69256

Indicators of Compromise

Chatflow definitions containing read_pickle or pd.read_pickle in CSV Agent customReadCSVFunc parameters
Outbound HTTP or DNS requests from the Flowise host to attacker-controlled URLs referenced inside pickle payloads
Unexpected child processes spawned by the Node.js Flowise process, particularly Python or shell interpreters
POST requests to /api/v1/prediction/<UUID> immediately following chatflow save operations by non-administrative accounts

Detection Strategies

Inspect Flowise database entries for chatflows that include the customReadCSVFunc field and flag any value not matching a strict read_csv(...) pattern.
Monitor Pyodide runtime logs for evaluation of read_pickle, read_parquet, or other deserialization-capable pandas functions.
Correlate chatflow modification events with subsequent prediction API invocations from the same session or IP.

Monitoring Recommendations

Enable audit logging for chatflow create, update, and prediction API activity, and forward logs to a centralized SIEM.
Baseline expected network egress from the Flowise host and alert on new destinations following prediction execution.
Track process lineage from the Flowise service to detect unexpected command execution.

How to Mitigate CVE-2026-69256

Immediate Actions Required

Upgrade Flowise to version 3.1.3 or later, which introduces validateCustomReadCSVFunction and blocks read_pickle.
Audit all existing chatflows for CSV Agent nodes with populated customReadCSVFunc fields and remove any non-compliant entries.
Rotate credentials, API keys, and secrets accessible to the Flowise process if exploitation is suspected.
Restrict chatflow create and modify permissions to trusted administrators until patching is complete.

Patch Information

The fix is available in Flowise 3.1.3. The corrective commit is c79fe56, delivered via pull request #6257. The patch replaces the denylist for the custom CSV field with an allowlist that only permits read_csv(...) calls and additionally blocks read_pickle and class definitions in the broader DataFrame validator.

Workarounds

Disable the CSV Agent node type in deployments that cannot be upgraded immediately.
Enforce strict role-based access control so only vetted users can create or edit chatflows.
Place the Flowise instance behind an authenticating reverse proxy and block direct external access to /api/v1/prediction/.
Run Flowise inside a hardened container with no outbound network egress and a read-only filesystem where possible.

bash

# Upgrade Flowise to the patched release
npm install -g flowise@3.1.3

# Or for Docker deployments
docker pull flowiseai/flowise:3.1.3
docker stop flowise && docker rm flowise
docker run -d --name flowise -p 3000:3000 flowiseai/flowise:3.1.3