ZDI-26-546: Flowise Airtable_Agent Code Injection Remote Code Execution Vulnerability

Flowise before version 3.1.3 fails to sanitize the csvFile data URI in its CSV Agent node, interpolating an attacker-controlled string directly into a Python source template that is executed by Pyodide. Because Pyodide's default JavaScript bridge exposes eval and dynamic import on Node.js, an attacker can escape the Python string literal, import Node built-ins like fs and child_process, and run arbitrary file I/O or OS commands as the Flowise process. A workspace user with chatflows:create or agentflows/chatflows update permission can plant a malicious CSV Agent node, and any unauthenticated request to a publicly exposed chatflow endpoint (POST /api/v1/prediction/:id) then triggers host-level remote code execution. The existing validators (validatePythonCodeForDataFrame and validateCustomReadCSVFunction) are never applied to this bootstrap template, which is why the injection slipped through. The issue is fixed in version 3.1.3; a public advisory describes the flaw, EPSS is low (0.6%), and it is not in the CISA KEV catalog, with no confirmed in-the-wild exploitation reported.

Do: Upgrade Flowise to version 3.1.3 or later immediately. Audit existing chatflows and agentflows for CSV Agent nodes with unexpected csvFile data URIs, and restrict chatflows:create and update permissions to trusted workspace users only. Do not expose the /api/v1/prediction/:id endpoint to the public internet without authentication, and monitor the Flowise host for suspicious fs/child_process activity if multi-user workspaces were enabled prior to patching.