CVE-2026-69264: Flowise: CSV Agent template injection enables host RCE

Flowise's CSV Agent node builds a Python code template from user-supplied CSV data and runs it inside a Pyodide interpreter that, on Node.js, exposes a JavaScript bridge with eval and dynamic import — so a crafted csvFile data URI can break out of the Python string, call js.eval, and import Node's fs and child_process modules to execute arbitrary commands as the Flowise process. This isn't a niche edge case: any workspace member with chatflows:create or agentflows/chatflows update permission can plant the payload, and once that chatflow is exposed through the public POST /api/v1/prediction/:id endpoint, unauthenticated requests trigger full host RCE — turning an internal misconfiguration into an externally reachable compromise. There's no CISA KEV listing, no public exploit or Nuclei template yet, and EPSS sits at just 0.58% (top 55th percentile), so this isn't under active mass exploitation, and CISA's SSVC decision is "Attend" rather than immediate action. That said, flowise-components has already accumulated 158 other CVEs, signaling a pattern of weak input handling in this codebase, and the two validators built for exactly this class of bug (validatePythonCodeForDataFrame, validateCustomReadCSVFunction) were never wired into the vulnerable bootstrap path — a process gap worth flagging in any vendor risk review. Patch flowise and flowise-components to 3.1.3 now, audit existing chatflows for CSV Agent nodes with suspicious data URIs, and tighten chatflows:create/update permissions to trusted users only until the upgrade is confirmed.

No confirmed active exploitation of CVE-2026-69264 has been reported, but organizations should still patch proactively.

1) Upgrade flowise and flowise-components to >=3.1.3 immediately — this is the only complete fix. 2) Audit all existing chatflows/agentflows for CSVAgent nodes and inspect csvFile data URI contents for anomalous payloads (base64 blobs containing import/eval-like strings or unexpected Python string terminators). 3) Restrict chatflows:create and agentflows/chatflows update permissions to a minimal, trusted set of users and review workspace RBAC assignments. 4) Add host-based monitoring/EDR on the Flowise process for unexpected child_process spawns or fs access outside expected data directories. 5) Rate-limit and monitor the /api/v1/prediction/:id endpoint for anomalous invocation patterns, especially on newly published or rarely-used chatflows. 6) If other Pyodide-based or similar sandboxed-interpreter nodes are in use, confirm with the vendor that the js bridge to globalThis is disabled or restricted (no eval, no dynamic import) rather than assuming sandbox isolation.

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code AI orchestration, code execution sandboxes, agent tool invocation pipelines.

No CVSS score has been assigned yet.