ZDI-26-545: Flowise CSV_Agent customReadCSV Code Injection Remote Code Execution Vulnerability

Flowise, an open-source drag-and-drop builder for LLM workflows, contains a code injection flaw in its CSV Agent node in versions prior to 3.1.3. The node evaluates the user-supplied Additional Parameters field customReadCSVFunc as pd.${customReadCSVFunc} inside pyodide, and although a denylist blocks dangerous Python constructs, an attacker can call pandas.read_pickle() to deserialize a crafted pickled payload and execute arbitrary Python commands on the host. Exploitation requires an authenticated account able to create or modify a chatflow: the attacker adds a CSV Agent, embeds the malicious read_pickle payload, saves the flow, and triggers it via /api/v1/prediction/, yielding full command execution with high impact to confidentiality, integrity, and availability (CVSS 4.0: 9.4). Any self-hosted Flowise deployment on a version before 3.1.3 that allows untrusted or low-privilege users to build or edit chatflows is affected. The flaw is fixed in 3.1.3; technical details and a public advisory exist, but no in-the-wild exploitation is known and EPSS is low (0.4%, 33rd percentile).

Do: Upgrade Flowise to version 3.1.3 or later immediately. Restrict chatflow creation and editing to trusted, vetted users only, since the flaw requires authenticated flow-builder access. Audit existing chatflows for suspicious customReadCSVFunc / read_pickle content in CSV Agent Additional Parameters and review server logs for unexpected command execution following calls to /api/v1/prediction/.