CVE-2026-70477: Flowise CSV Agent RCE Vulnerability

CVE-2026-70477 Overview

CVE-2026-70477 is a critical code injection vulnerability in Flowise, a drag-and-drop interface for building large language model (LLM) workflows. Versions prior to 3.1.3 allow attackers to bypass the Python blocklist validator through prompt injection targeting the CSV Agent node. A crafted prompt sent to a chatflow coerces the LLM into producing a malicious Python script that passes validatePythonCodeForDataFrame and executes inside an unsandboxed Pyodide runtime. The flaw resides in the run method of the CSV_Agents class, where untrusted input constructs the LLM prompt used to generate executable code. Successful exploitation yields arbitrary code execution as the Flowise service account.

Critical Impact
Remote, unauthenticated attackers can execute arbitrary Python in the Flowise service account context, compromising the host, connected data sources, and downstream LLM infrastructure.

Affected Products

Flowise versions prior to 3.1.3
Flowise chatflows configured with the CSV Agent node
Deployments exposing the Pyodide execution backend for CSV agents

Discovery Timeline

2026-08-04 - CVE-2026-70477 published to NVD
2026-08-05 - Last updated in NVD database
Flowise 3.1.3 - FlowiseAI releases patched version addressing the issue

Technical Details for CVE-2026-70477

Vulnerability Analysis

The vulnerability is a code injection flaw classified as [CWE-94] (Improper Control of Generation of Code). Flowise's CSV Agent node lets users ask natural-language questions about a CSV, which the LLM answers by generating pandas code executed under Pyodide. The system prompt instructs the model to emit only pandas or numpy operations on a dataframe named df, and validatePythonCodeForDataFrame is intended to reject imports and system calls. Prompt injection input supplied through the chat interface overrides those instructions, causing the LLM to emit Python that evades the blocklist and reaches the Pyodide runtime. Because Pyodide runs without an application-level sandbox in Flowise, the emitted code executes with the same privileges as the Node.js service.

Root Cause

The root cause combines two failures. First, untrusted chat content is concatenated into the LLM prompt inside the run method of CSV_Agents, giving attackers direct control over instructions the model follows. Second, validatePythonCodeForDataFrame performs blocklist-based string validation rather than semantic analysis, so obfuscated or indirect constructs that yield equivalent behavior to import, exec, open, or os calls slip through. Blocklist validation is not a defense against attacker-controlled code generation.

Attack Vector

The attack vector is network-based and requires no authentication in default deployments that expose chatflow prediction endpoints. An attacker sends a crafted prompt to a chatflow that uses a CSV Agent node. The prompt instructs the LLM to produce Python that appears to be a dataframe operation but achieves side effects such as file system access, outbound network requests, or command execution once evaluated in Pyodide. The generated code passes validation and executes in the service context.

typescript

// Patch excerpt from packages/components/nodes/agents/AirtableAgent/core.ts
// The systemPrompt that relied on blocklist wording for safety was removed
// as part of the fix in Flowise 3.1.3.
export const systemPrompt = `You are working with a pandas dataframe in Python. The name of the dataframe is df.

The columns and data types of a dataframe are given below as a Python dictionary with keys showing column names and values showing the data types.
{dict}

I will ask question, and you will output the Python code using pandas dataframe to answer my question. Do not provide any explanations. Do not respond with anything except the output of the code.

Security: Output ONLY pandas/numpy operations on the dataframe (df). Do not use import, exec, eval, open, os, subprocess, or any other system or file operations. The code will be validated and rejected if it contains such constructs.

Question: {question}
Output Code:`

Source: FlowiseAI/Flowise commit f4e2794

Detection Methods for CVE-2026-70477

Indicators of Compromise

Chatflow prediction requests containing Python keywords such as import, __import__, exec, eval, open, or os in user prompts targeting CSV Agent nodes.
Outbound network connections initiated by the Flowise Node.js process to unexpected hosts shortly after CSV Agent invocations.
Unexpected file writes under the Flowise service account, including into .flowise/pyodideCacheDir or the user home directory.
Process telemetry showing the Flowise service reading sensitive files (for example, /etc/passwd, cloud credential files) following chat activity.

Detection Strategies

Log all chatflow prompt bodies and generated Python code, then alert when generated code contains constructs outside a strict pandas/numpy allowlist.
Instrument the CSV_Agents.run path to record inputs, model outputs, and the pre-execution validation verdict for forensic review.
Monitor for anomalous child processes or syscalls originating from the Flowise service, since normal CSV agent use should not require them.

Monitoring Recommendations

Forward Flowise application logs and host EDR telemetry to a centralized analytics pipeline for correlation across prompt content and process behavior.
Baseline normal CSV Agent execution patterns and alert on deviations such as new outbound domains, new file paths, or new process creations.
Track the Flowise version deployed in each environment and flag any instance still below 3.1.3.

How to Mitigate CVE-2026-70477

Immediate Actions Required

Upgrade Flowise to version 3.1.3 or later on all instances that expose chatflows.
Restrict network exposure of Flowise chatflow endpoints to authenticated, trusted users until the upgrade is verified.
Audit existing chatflows and disable or remove CSV Agent nodes on unpatched deployments.
Rotate credentials, API keys, and tokens accessible to the Flowise service account, since prior exploitation cannot be ruled out.

Patch Information

The issue is fixed in Flowise 3.1.3. Details are published in GitHub Security Advisory GHSA-5xvg-pmgg-3mxr, with code changes in Pull Request #6499 and commit f4e2794. The release is available at flowise@3.1.3.

Workarounds

Remove CSV Agent nodes from all chatflows until the upgrade is completed.
Place Flowise behind an authenticating reverse proxy and restrict chatflow prediction endpoints to known clients.
Run the Flowise service under a least-privilege user with no access to secrets, credential files, or outbound network destinations beyond what LLM calls require.

bash

# Upgrade Flowise to the patched release
npm install -g flowise@3.1.3

# Or, when running via Docker, pull the fixed image tag
docker pull flowiseai/flowise:3.1.3
docker stop flowise && docker rm flowise
docker run -d --name flowise -p 3000:3000 flowiseai/flowise:3.1.3