ZDI-26-634: Flowise CSV Agent Prompt Injection Remote Code Execution Vulnerability
ZDI disclosed a CVSS 9.8 unauthenticated prompt injection vulnerability in Flowise's CSV agent that allows remote arbitrary code execution.
ZDI published advisory ZDI-26-634 for a prompt injection vulnerability in Flowise's CSV agent component. Remote, unauthenticated attackers can inject prompts to execute arbitrary code on affected installations. ZDI assigned CVSS 9.8 and the issue is tracked as CVE-2026-70477.
40