RCE in Flowise CSVAgent via Pyodide Code Injection (pre-3.1.3)
CVSS 4.0
9.4critical
EPSS
1%p65
Published
()
Modified
AI analysis
Flowise before version 3.1.3 fails to sanitize the csvFile data URI in its CSV Agent node, interpolating an attacker-controlled string directly into a Python source template that is executed by Pyodide. Because Pyodide's default JavaScript bridge exposes eval and dynamic import on Node.js, an attacker can escape the Python string literal, import Node built-ins like fs and child_process, and run arbitrary file I/O or OS commands as the Flowise process. A workspace user with chatflows:create or agentflows/chatflows update permission can plant a malicious CSV Agent node, and any unauthenticated request to a publicly exposed chatflow endpoint (POST /api/v1/prediction/:id) then triggers host-level remote code execution. The existing validators (validatePythonCodeForDataFrame and validateCustomReadCSVFunction) are never applied to this bootstrap template, which is why the injection slipped through. The issue is fixed in version 3.1.3; a public advisory describes the flaw, EPSS is low (0.6%), and it is not in the CISA KEV catalog, with no confirmed in-the-wild exploitation reported.
What to do: Upgrade Flowise to version 3.1.3 or later immediately. Audit existing chatflows and agentflows for CSV Agent nodes with unexpected csvFile data URIs, and restrict chatflows:create and update permissions to trusted workspace users only. Do not expose the /api/v1/prediction/:id endpoint to the public internet without authentication, and monitor the Flowise host for suspicious fs/child_process activity if multi-user workspaces were enabled prior to patching.
Affected
flowiseai flowise
All versions prior to 3.1.3 (< 3.1.3); fixed in 3.1.3
Estimated exposure
moderate≈ low thousands of internet-exposed self-hosted Flowise instances, likely tens of thousands of total deployments — Flowise is self-hosted open-source software with no plugin install metrics; public internet scans (Shodan/Censys-type) typically show on the order of a few thousand exposed Flowise instances, so clearly an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import, the attacker can break out of the Python string literal, hand a JavaScript string to js.eval, dynamically import Node built-in modules such as fs and child_process, and execute arbitrary file I/O or OS commands as the Flowise process. The two validator paths around this code, validatePythonCodeForDataFrame and validateCustomReadCSVFunction, are never applied to the bootstrap template. A workspace user with chatflows:create or agentflows/chatflows update permission can plant a CSV Agent node with a crafted csvFile; once the chatflow is exposed via POST /api/v1/prediction/:id, any unauthenticated request triggers host remote code execution. This issue is fixed in version 3.1.3.
ZDI discloses an unauthenticated code injection remote code execution flaw in Flowise's Airtable_Agent (CVE-2026-69264, CVSS 9.8).
ZDI advisory ZDI-26-546 describes a code injection vulnerability in the Flowise Airtable_Agent that allows remote attackers to execute arbitrary code. No authentication is required to exploit the flaw, which carries a CVSS rating of 9.8 and is assigned CVE-2026-69264. Flowise deployments exposing the vulnerable agent component are at risk of full server takeover.