ZDI-26-545: Flowise CSV_Agent customReadCSV Code Injection Remote Code Execution Vulnerability
ZDI discloses CVE-2026-69256, a CVSS 8.8 code injection in Flowise CSV_Agent customReadCSV allowing authenticated remote attackers to execute arbitrary code.
ZDI advisory ZDI-26-545 describes a code injection vulnerability in Flowise's CSV_Agent customReadCSV functionality, tracked as CVE-2026-69256 with a CVSS score of 8.8. It allows remote attackers to execute arbitrary code on affected Flowise installations. Authentication is required to exploit the vulnerability.
- CVE-2026-69256: code injection in Flowise CSV_Agent customReadCSV
- CVSS 8.8; remote code execution after authentication
- Relevant to Flowise deployments used for LLM workflows
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-69256 | Authenticated Code Injection RCE in Flowise CSV Agent (pre-3.1.3) | 9.4 | 1% | PoC |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.