CVE-2026-69264: Flowise CSVAgent RCE Vulnerability

CVE-2026-69264 Overview

CVE-2026-69264 is a critical remote code execution vulnerability in Flowise, an open-source low-code platform for building large language model (LLM) applications. The flaw resides in the CSVAgent node, which interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, attackers can escape the Python string literal, invoke js.eval, and dynamically import Node.js built-in modules such as fs and child_process. The vulnerability is tracked as [CWE-94] Code Injection and is fixed in Flowise version 3.1.3.

Critical Impact
Any unauthenticated request to POST /api/v1/prediction/:id on a chatflow containing a malicious CSV Agent node triggers arbitrary OS command execution as the Flowise process.

Affected Products

Flowise versions prior to 3.1.3
Flowise CSVAgent node component
Deployments exposing chatflows via POST /api/v1/prediction/:id

Discovery Timeline

2026-08-04 - CVE-2026-69264 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-69264

Vulnerability Analysis

The Flowise CSVAgent node builds a Python bootstrap template that reads a CSV file from a data URI supplied through the chatflow configuration. The csvFile value is interpolated into the Python source as an unescaped string, breaking the assumption that Pyodide provides a sandboxed execution boundary. Pyodide, running inside Node.js, exposes the JavaScript host through the js module bound to globalThis, which grants access to eval and dynamic import(). An attacker who breaks out of the Python string literal can call js.eval with arbitrary JavaScript, load Node built-ins such as fs and child_process, and execute host commands.

The two validator paths intended to constrain generated code, validatePythonCodeForDataFrame and validateCustomReadCSVFunction, are never invoked against the bootstrap template. This leaves the injection point completely unfiltered.

Root Cause

The root cause is unsafe string interpolation of untrusted input into a Python source template combined with a Pyodide runtime configured with unrestricted JavaScript host access. Sanitization routines exist elsewhere in the CSVAgent code path but are not applied to the bootstrap template that consumes the csvFile URI.

Attack Vector

A workspace user with chatflows:create or agentflows/chatflows update permission plants a CSV Agent node containing a crafted csvFile data URI. Once the chatflow is exposed through POST /api/v1/prediction/:id, any unauthenticated HTTP request triggers execution of the injected payload. The attacker gains code execution with the privileges of the Flowise process, enabling file I/O, credential theft, and lateral movement.

typescript

// Patch context: the vulnerable CSVAgent core.ts loaded Pyodide and constructed
// a Python bootstrap template around user-supplied csvFile input.
// The fix (Flowise PR #6499) removes the vulnerable bootstrap path.

-import type { PyodideInterface } from 'pyodide'
-import * as path from 'path'
-import { getUserHome } from '../../../src/utils'
-
-let pyodideInstance: PyodideInterface | undefined
-
-export async function LoadPyodide(): Promise<PyodideInterface> {
-    if (pyodideInstance === undefined) {
-        const { loadPyodide } = await import('pyodide')
-        const obj: any = { packageCacheDir: path.join(getUserHome(), '.flowise', 'pyodideCacheDir') }
-        pyodideInstance = await loadPyodide(obj)
-        await pyodideInstance.loadPackage(['pandas', 'numpy'])
-    }
-    return pyodideInstance
-}
// Source: https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c

Detection Methods for CVE-2026-69264

Indicators of Compromise

Unexpected child processes spawned by the Flowise Node.js process, particularly shells (sh, bash) or system utilities invoked via child_process.
Unusual outbound network connections initiated by the Flowise process to attacker-controlled infrastructure.
Chatflow definitions containing CSV Agent nodes with csvFile values that include Python string-terminating characters or references to js.eval.
Requests to POST /api/v1/prediction/:id followed immediately by filesystem or process activity outside normal Flowise behavior.

Detection Strategies

Audit stored chatflow and agentflow JSON for CSV Agent nodes and inspect csvFile values for non-standard payloads or embedded quotes and backticks.
Monitor the Flowise process for spawns of child_process descendants and correlate with inbound HTTP prediction requests.
Enable process command-line logging on hosts running Flowise to capture Node.js import('fs') or import('child_process') execution patterns.

Monitoring Recommendations

Log all authenticated actions against the Flowise chatflow management API, focusing on create and update operations.
Capture and retain HTTP access logs for /api/v1/prediction/:id to enable retrospective triage.
Alert on Flowise processes reading sensitive files such as /etc/passwd, SSH keys, or application secrets.

How to Mitigate CVE-2026-69264

Immediate Actions Required

Upgrade Flowise to version 3.1.3 or later, which removes the vulnerable Pyodide bootstrap path.
Review all existing chatflows and agentflows for CSV Agent nodes and remove or rebuild any authored by untrusted workspace users.
Restrict who can create or update chatflows by tightening the chatflows:create and agentflows/chatflows update permissions.
Rotate credentials and API keys accessible to the Flowise process if compromise is suspected.

Patch Information

The fix is delivered in Flowise 3.1.3 via Pull Request #6499 and commit f4e2794. See the GitHub Security Advisory GHSA-4j8x-x6v7-w9rq for the vendor's disclosure details.

Workarounds

Disable the CSVAgent node in workspaces that cannot immediately upgrade to 3.1.3.
Place Flowise behind an authenticating reverse proxy so that POST /api/v1/prediction/:id requires valid credentials.
Run Flowise as an unprivileged user inside a hardened container with read-only filesystem and restricted egress.

bash

# Upgrade Flowise to the patched release
npm install -g flowise@3.1.3

# Verify the installed version
flowise --version

# If running via Docker, pull the fixed image tag
docker pull flowiseai/flowise:3.1.3