CVE-2026-69256: Flowise RCE — CRITICAL

CISO Take

Flowise's CSVAgent node lets a user supply a custom pandas read function that is evaluated server-side inside a Python (pyodide) sandbox, and while a denylist blocks obviously dangerous keywords, pandas.read_pickle() slips past it and deserializes an attacker-controlled pickle payload to achieve arbitrary code execution. Any authenticated user able to create or edit a chatflow — which in many self-hosted or shared-workspace Flowise deployments includes lower-trust internal users — can weaponize this by adding a CSV Agent node and hitting the prediction endpoint, with no exploit chain or special tooling required, making it trivially reproducible despite the low EPSS score of 0.39% (top 68th percentile) and no current KEV listing or public exploit/scanner. The blast radius is amplified by the fact that this package carries 158 other recorded CVEs, pointing to a broader pattern of insufficiently hardened code-execution surfaces in the product. Upgrade any Flowise/flowise-components install to 3.1.3 immediately; where immediate patching isn't possible, restrict chatflow creation and editing to fully trusted users and monitor `/api/v1/prediction/<UUID>` invocations for chatflows containing CSVAgent nodes with unusual Additional Parameters values (especially references to read_pickle).

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

Critical severity and low exploitation complexity combine with a denylist-based mitigation that is fundamentally bypassable — pickle deserialization is a well-documented denylist evasion vector, so this is not a novel technique, just an unblocked one. Exploitability is high for anyone with chatflow-authoring privileges (low privilege bar, no user interaction needed beyond triggering the flow), but exposure is gated by how broadly an organization grants chatflow creation rights; multi-tenant or shared Flowise instances are at materially higher risk than single-admin deployments. No active exploitation or public PoC lowers near-term urgency slightly, but the triviality of reproduction once described in the advisory means that gap will likely close quickly.

How does the attack unfold?

Initial Access

Attacker uses valid authenticated credentials with chatflow create/edit permissions on a Flowise instance.

AML.T0012

Tool Configuration Abuse

Attacker adds a CSV Agent node and sets Additional Parameters to a malicious pandas.read_pickle() payload that bypasses the keyword denylist.

AML.T0081

Exploitation

Attacker triggers the chatflow via /api/v1/prediction/<UUID>, causing the backend to evaluate pd.${customReadCSVFunc} and deserialize the malicious pickle, executing arbitrary code.

AML.T0053

Impact

Attacker achieves remote code execution on the Flowise server, enabling data theft, credential harvesting, or lateral movement to connected systems.

AML.T0048

Initial Access

Attacker uses valid authenticated credentials with chatflow create/edit permissions on a Flowise instance.

AML.T0012

Tool Configuration Abuse

Attacker adds a CSV Agent node and sets Additional Parameters to a malicious pandas.read_pickle() payload that bypasses the keyword denylist.

AML.T0081

Exploitation

Attacker triggers the chatflow via /api/v1/prediction/<UUID>, causing the backend to evaluate pd.${customReadCSVFunc} and deserialize the malicious pickle, executing arbitrary code.

AML.T0053

Impact

Attacker achieves remote code execution on the Flowise server, enabling data theft, credential harvesting, or lateral movement to connected systems.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	<= 3.1.2	`3.1.3`
Flowise	npm	<= 3.1.2	`3.1.3`

How severe is it?

CVSS 3.1

N/A

EPSS

0.8%

chance of exploitation in 30 days

Higher than 54% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Upgrade flowise and flowise-components to 3.1.3 or later immediately — this is the only complete fix. 2) Until patched, disable or restrict access to the CSVAgent node, or restrict chatflow create/edit permissions to fully trusted administrators only. 3) Audit existing chatflows for CSVAgent nodes with Additional Parameters referencing read_pickle, pickle, or unusual pandas method chains. 4) Monitor logs for /api/v1/prediction/<UUID> calls tied to chatflows containing CSVAgent nodes, especially from non-admin accounts. 5) Run Flowise with least-privilege OS-level isolation (containers, restricted service accounts, no unnecessary network egress) so that even a successful RCE has limited blast radius.

How is it classified?

Code Execution Supply Chain Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system verification and validation

NIST AI RMF

MANAGE-4.1 - Risk treatment for third-party AI resources

OWASP LLM Top 10

LLM05 - Improper Output Handling LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-69256?

Flowise's CSVAgent node lets a user supply a custom pandas read function that is evaluated server-side inside a Python (pyodide) sandbox, and while a denylist blocks obviously dangerous keywords, pandas.read_pickle() slips past it and deserializes an attacker-controlled pickle payload to achieve arbitrary code execution. Any authenticated user able to create or edit a chatflow — which in many self-hosted or shared-workspace Flowise deployments includes lower-trust internal users — can weaponize this by adding a CSV Agent node and hitting the prediction endpoint, with no exploit chain or special tooling required, making it trivially reproducible despite the low EPSS score of 0.39% (top 68th percentile) and no current KEV listing or public exploit/scanner. The blast radius is amplified by the fact that this package carries 158 other recorded CVEs, pointing to a broader pattern of insufficiently hardened code-execution surfaces in the product. Upgrade any Flowise/flowise-components install to 3.1.3 immediately; where immediate patching isn't possible, restrict chatflow creation and editing to fully trusted users and monitor `/api/v1/prediction/<UUID>` invocations for chatflows containing CSVAgent nodes with unusual Additional Parameters values (especially references to read_pickle).

Is CVE-2026-69256 actively exploited?

No confirmed active exploitation of CVE-2026-69256 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-69256?

1) Upgrade flowise and flowise-components to 3.1.3 or later immediately — this is the only complete fix. 2) Until patched, disable or restrict access to the CSVAgent node, or restrict chatflow create/edit permissions to fully trusted administrators only. 3) Audit existing chatflows for CSVAgent nodes with Additional Parameters referencing read_pickle, pickle, or unusual pandas method chains. 4) Monitor logs for /api/v1/prediction/<UUID> calls tied to chatflows containing CSVAgent nodes, especially from non-admin accounts. 5) Run Flowise with least-privilege OS-level isolation (containers, restricted service accounts, no unnecessary network egress) so that even a successful RCE has limited blast radius.

What systems are affected by CVE-2026-69256?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code/no-code AI orchestration.

What is the CVSS score for CVE-2026-69256?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworkslow-code/no-code AI orchestration

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM05, LLM08

What are the technical details?

Original Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/<UUID> to execute commands. This issue is fixed in version 3.1.3.

Exploitation Scenario

An adversary with a standard authenticated account on a shared or multi-tenant Flowise instance creates a new chatflow and adds a CSV Agent node. In the node's Additional Parameters, they set customReadCSVFunc to a payload that calls read_pickle() against a crafted pickle file (either uploaded or referenced via URL) containing a malicious __reduce__ method that spawns a reverse shell or executes arbitrary commands. They save the chatflow and send a request to /api/v1/prediction/<UUID>, which evaluates pd.${customReadCSVFunc}, triggering deserialization and command execution on the Flowise backend — granting the attacker a foothold to pivot to other tenants' data, embedded API keys, or connected infrastructure.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.