CVE-2026-69255

Flowise, an open-source drag-and-drop tool for building LLM workflows, contained a critical Python code injection (CWE-94) in its CSVAgent component in all versions prior to 3.1.3. The agent parsed attacker-controlled CSV content with file.split(',').pop() and interpolated the result directly into a Python code block executed by the Pyodide runtime, bypassing the validatePythonCodeForDataFrame() denylist, which only inspected later LLM-generated code. By injecting a closing quote plus arbitrary Python, an attacker (described in the advisory as authenticated, though the CVSS 4.0 vector scores privileges as not required) could reach Pyodide's JavaScript bridge, load Node.js's child_process module, and run arbitrary operating-system commands as root inside the Flowise container. Anyone running a self-hosted Flowise instance below 3.1.3 that exposes the CSVAgent to users uploading CSV files is affected. The flaw is fixed in version 3.1.3; a technical write-up of the attack chain is public via the GitHub advisory, EPSS is low (0.6%), and there is no evidence of in-the-wild exploitation.

What to do: Upgrade Flowise to version 3.1.3 or later, which validates the injected CSVAgent code block. If immediate upgrade is not possible, restrict access to chatflows using the CSVAgent, avoid exposing Flowise directly to the internet, and require authentication so untrusted users cannot upload CSV input. Review container logs and process history for unexpected child_process/shell activity and consider running Flowise as a non-root user with network egress restrictions.