AI Threat Alert
CVE-2026-69255: Flowise: code injection in CSVAgent enables root RCE
GHSA-vmv7-4m6c-3cg5 UNKNOWN CISA: ATTENDFlowise's CSVAgent node builds a Python snippet by directly interpolating attacker-controlled CSV data into a string (base64_string = "${base64String}") before handing it to the Pyodide interpreter, and the existing denylist only screens later LLM-generated code, so the initial injection point was never validated. Any authenticated user of a Flowise instance can inject a closing quote plus arbitrary Python, then use Pyodide's js bridge to reach Node's child_process module and execute OS commands as root inside the container — a full sandbox escape, not a contained scripting bug. This affects flowise and flowise-components with 158 other CVEs already logged against the package, and while EPSS sits low (0.00313, though ranked in the top 76% of scored CVEs) with no public exploit, PoC, Nuclei template, or CISA KEV listing, the required authentication is a low bar in most low-code deployments where multiple business users hold accounts. CISA's SSVC decision is ATTEND, meaning organizations should track it on a normal patch cycle rather than treat it as an emergency, but any org running self-hosted Flowise below 3.1.3 with the CSVAgent enabled should patch to 3.1.3 immediately given the root-in-container blast radius. In the interim, disable or restrict CSVAgent to trusted admins and monitor for unexpected child_process spawns from the Pyodide/Flowise process.
What is the risk?
Moderate-to-high technical severity (unauthenticated CVSS score is unavailable, but the outcome is root code execution inside the application container) offset by a meaningful exploitation barrier: the attacker must already hold an authenticated Flowise account and understand how to craft a CSV payload that survives file.split(',').pop() extraction and breaks out of the interpolated Python string. There is no evidence of active exploitation (not in CISA KEV), no public PoC, and no Nuclei template, and EPSS scores it low in absolute terms. The primary exposure driver is deployment pattern: multi-tenant or team-shared Flowise instances where many internal users have accounts turn 'authenticated' into a low practical barrier, and a root container compromise can be a pivot point into internal infrastructure, secrets, and other agent flows hosted on the same node.
How does the attack unfold?
What systems are affected?
How severe is it?
What should I do?
1 step-
1) Upgrade flowise and flowise-components to 3.1.3 or later immediately — this is the only complete fix. 2) Until patched, disable the CSVAgent node or restrict its use to fully trusted/admin accounts only; do not expose it to lower-trust internal users. 3) Run Flowise containers with least-privilege (non-root) where the platform allows, and use container-level egress/process controls to detect or block unexpected child_process/os-command execution originating from the Node/Pyodide process. 4) Audit Flowise instance logs for CSVAgent invocations with anomalous CSV content (unexpected quote characters, embedded Python-like syntax) around the disclosure window. 5) Rotate any credentials or API keys accessible to the Flowise container if you cannot confirm the instance was unaffected prior to patching.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-69255?
Flowise's CSVAgent node builds a Python snippet by directly interpolating attacker-controlled CSV data into a string (base64_string = "${base64String}") before handing it to the Pyodide interpreter, and the existing denylist only screens later LLM-generated code, so the initial injection point was never validated. Any authenticated user of a Flowise instance can inject a closing quote plus arbitrary Python, then use Pyodide's js bridge to reach Node's child_process module and execute OS commands as root inside the container — a full sandbox escape, not a contained scripting bug. This affects flowise and flowise-components with 158 other CVEs already logged against the package, and while EPSS sits low (0.00313, though ranked in the top 76% of scored CVEs) with no public exploit, PoC, Nuclei template, or CISA KEV listing, the required authentication is a low bar in most low-code deployments where multiple business users hold accounts. CISA's SSVC decision is ATTEND, meaning organizations should track it on a normal patch cycle rather than treat it as an emergency, but any org running self-hosted Flowise below 3.1.3 with the CSVAgent enabled should patch to 3.1.3 immediately given the root-in-container blast radius. In the interim, disable or restrict CSVAgent to trusted admins and monitor for unexpected child_process spawns from the Pyodide/Flowise process.
Is CVE-2026-69255 actively exploited?
No confirmed active exploitation of CVE-2026-69255 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-69255?
1) Upgrade flowise and flowise-components to 3.1.3 or later immediately — this is the only complete fix. 2) Until patched, disable the CSVAgent node or restrict its use to fully trusted/admin accounts only; do not expose it to lower-trust internal users. 3) Run Flowise containers with least-privilege (non-root) where the platform allows, and use container-level egress/process controls to detect or block unexpected child_process/os-command execution originating from the Node/Pyodide process. 4) Audit Flowise instance logs for CSVAgent invocations with anomalous CSV content (unexpected quote characters, embedded Python-like syntax) around the disclosure window. 5) Rotate any credentials or API keys accessible to the Flowise container if you cannot confirm the instance was unaffected prior to patching.
What systems are affected by CVE-2026-69255?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code AI orchestration, code execution sandboxes, data analysis agents.
What is the CVSS score for CVE-2026-69255?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0049 Exploit Public-Facing Application AML.T0050 Command and Scripting Interpreter AML.T0053 AI Agent Tool Invocation AML.T0105 Escape to Host Compliance Controls Affected
What are the technical details?
Original Advisory
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split(',').pop() and interpolated it directly into executable Python as base64_string = "${base64String}" before calling Pyodide. The validatePythonCodeForDataFrame() denylist only checked later LLM-generated code and did not validate this initial code block. An authenticated attacker could inject a closing quote followed by Python code, use Pyodide's js bridge to load Node.js child_process, and execute arbitrary operating system commands as root in the Flowise container. This issue is fixed in version 3.1.3.
Exploitation Scenario
An attacker who has obtained (or been granted) a low-privilege authenticated account on a self-hosted Flowise instance builds or edits an agent flow that includes the CSVAgent node. They upload or reference a CSV file whose content is crafted so that file.split(',').pop() extracts a value ending in a closing double-quote, terminating the intended base64_string = "..." Python assignment early. The attacker appends arbitrary Python after that injected quote, which Pyodide then executes as part of the agent's data-analysis step. From within that Python context, the attacker uses Pyodide's js interop bridge to call into the host Node.js runtime and invoke child_process, escaping the WASM sandbox entirely and running arbitrary OS commands with root privileges inside the Flowise container — from there pivoting to read environment secrets, other configured agent credentials, or the underlying host network.
Weaknesses (CWE)
CWE-94 Improper Control of Generation of Code ('Code Injection')
Primary
CWE-94 Improper Control of Generation of Code ('Code Injection')
Primary
CWE-94 Improper Control of Generation of Code ('Code Injection') CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- [Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
- [Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2025-71338 10.0 Flowise: unauthenticated file write enables RCE
Same package: flowise CVE-2025-59528 10.0 Flowise: Unauthenticated RCE via MCP config injection
Same package: flowise CVE-2025-61913 9.9 Flowise: path traversal in file tools leads to RCE
Same package: flowise CVE-2026-40933 9.9 Flowise: RCE via MCP stdio command injection
Same package: flowise CVE-2026-46442 9.9 Flowise: sandbox escape enables authenticated RCE
Same package: flowise