CVE-2026-70477: Flowise prompt injection bypasses

Q: Is CVE-2026-70477 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-70477, increasing the risk of exploitation.

Q: How to fix CVE-2026-70477?

1) Upgrade Flowise and flowise-components to 3.1.3 or later immediately — this is the primary and complete fix. 2) Until patched, disable or restrict the CSV Agent node in any chatflow that processes external, user-uploaded, or otherwise untrusted CSV data. 3) Run Flowise's Pyodide execution context with least-privilege service account credentials and no access to secrets/environment variables it doesn't need, since blocklist validators should not be treated as a hard security boundary. 4) Add egress/network restrictions around the Flowise host to limit lateral movement if code execution occurs. 5) Monitor Flowise application logs and chatflow execution history for anomalous generated Python (e.g., import statements for os, subprocess, socket, or attempts to access the filesystem outside the expected DataFrame scope). 6) Review the GHSA-5xvg-pmgg-3mxr advisory and commit f4e2794 to understand the exact validator bypass pattern for detection engineering.

Q: What systems are affected by CVE-2026-70477?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code/no-code AI builders, code interpreter / code execution tools, data analysis agents.

Q: What is the CVSS score for CVE-2026-70477?

No CVSS score has been assigned yet.

CISO Take

A flaw in Flowise's CSV Agent node lets an attacker embed a prompt injection in data fed to the agent that convinces the LLM to generate malicious Python which slips past the validatePythonCodeForDataFrame blocklist and runs unsandboxed inside the Pyodide environment powering the agent's code-execution tool. For CISOs this is a case where an AI agent's own code-execution capability becomes the attack surface: the agent isn't tricked into leaking data, it's tricked into running arbitrary code as the service account, a materially worse outcome than typical prompt-injection data leakage. A public PoC exists and the CVE sits at the 63rd EPSS percentile, though it is not yet in CISA KEV and CISA's SSVC decision is the lower-urgency "Attend" tier, and the affected package shows zero tracked downstream dependents, so blast radius is bounded to organizations that actually run Flowise chatflows with the CSV Agent node exposed to untrusted input. Patch to flowise/flowise-components 3.1.3 immediately, and until then treat any chatflow using the CSV Agent node as executing attacker-influenced code — disable it for flows ingesting external or user-supplied CSV data and review the permissions granted to the Pyodide execution context, since this bug proves a code blocklist alone is not a reliable security boundary for LLM-generated code.

Sources: NVD GitHub Advisory EPSS ATLAS

What is the risk?

Moderate risk. There is no CVSS score published, but the technical severity is high in nature (unsandboxed arbitrary code execution as the service account) tempered by narrow exploitability preconditions: the attacker needs a chatflow path that lets them inject data into a CSV Agent node. EPSS (0.44%, ~63rd percentile) and CISA's SSVC "Attend" rating both suggest this is not being mass-exploited today, and it is absent from CISA KEV. Zero tracked downstream npm dependents limits the transitive supply-chain exposure, but any organization running self-hosted or hosted Flowise instances with CSV Agent flows exposed to external or semi-trusted input (a common pattern for data-analysis chatbots) is directly at risk. A working PoC and a clear, well-documented bypass technique (a specific validator function named in the advisory) lower the bar for a motivated attacker to weaponize this quickly.

How does the attack unfold?

Initial Access

Attacker embeds a prompt injection payload inside CSV data that will be ingested by a Flowise chatflow's CSV Agent node.

AML.T0051.001

Manipulation

The injected content causes the LLM to draft malicious Python code crafted to evade the validatePythonCodeForDataFrame blocklist.

AML.T0102

Execution

The CSV_Agents run method passes the unvalidated-enough pythonCode to the Pyodide interpreter, which executes it without sandbox isolation.

AML.T0050

Impact

Arbitrary code runs in the context of the Flowise service account, enabling data exfiltration, credential theft, or lateral movement.

Initial Access

Attacker embeds a prompt injection payload inside CSV data that will be ingested by a Flowise chatflow's CSV Agent node.

AML.T0051.001

Manipulation

The injected content causes the LLM to draft malicious Python code crafted to evade the validatePythonCodeForDataFrame blocklist.

AML.T0102

Execution

The CSV_Agents run method passes the unvalidated-enough pythonCode to the Pyodide interpreter, which executes it without sandbox isolation.

AML.T0050

Impact

Arbitrary code runs in the context of the Flowise service account, enabling data exfiltration, credential theft, or lateral movement.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	<= 3.1.2	`3.1.3`
Flowise	npm	<= 3.1.2	`3.1.3`

How severe is it?

CVSS 3.1

N/A

EPSS

0.8%

chance of exploitation in 30 days

Higher than 56% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

1) Upgrade Flowise and flowise-components to 3.1.3 or later immediately — this is the primary and complete fix. 2) Until patched, disable or restrict the CSV Agent node in any chatflow that processes external, user-uploaded, or otherwise untrusted CSV data. 3) Run Flowise's Pyodide execution context with least-privilege service account credentials and no access to secrets/environment variables it doesn't need, since blocklist validators should not be treated as a hard security boundary. 4) Add egress/network restrictions around the Flowise host to limit lateral movement if code execution occurs. 5) Monitor Flowise application logs and chatflow execution history for anomalous generated Python (e.g., import statements for os, subprocess, socket, or attempts to access the filesystem outside the expected DataFrame scope). 6) Review the GHSA-5xvg-pmgg-3mxr advisory and commit f4e2794 to understand the exact validator bypass pattern for detection engineering.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Prompt Injection Code Execution Agent Plugin AML.T0050 - Command and Scripting Interpreter AML.T0051.001 - Indirect AML.T0053 - AI Agent Tool Invocation AML.T0102 - Generate Malicious Commands

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system operation and monitoring

NIST AI RMF

MANAGE-2.3 - Mechanisms for managing AI system risks are in place and operating

OWASP LLM Top 10

LLM01 - Prompt Injection LLM02 - Insecure Output Handling

Frequently Asked Questions

What is CVE-2026-70477?

A flaw in Flowise's CSV Agent node lets an attacker embed a prompt injection in data fed to the agent that convinces the LLM to generate malicious Python which slips past the validatePythonCodeForDataFrame blocklist and runs unsandboxed inside the Pyodide environment powering the agent's code-execution tool. For CISOs this is a case where an AI agent's own code-execution capability becomes the attack surface: the agent isn't tricked into leaking data, it's tricked into running arbitrary code as the service account, a materially worse outcome than typical prompt-injection data leakage. A public PoC exists and the CVE sits at the 63rd EPSS percentile, though it is not yet in CISA KEV and CISA's SSVC decision is the lower-urgency "Attend" tier, and the affected package shows zero tracked downstream dependents, so blast radius is bounded to organizations that actually run Flowise chatflows with the CSV Agent node exposed to untrusted input. Patch to flowise/flowise-components 3.1.3 immediately, and until then treat any chatflow using the CSV Agent node as executing attacker-influenced code — disable it for flows ingesting external or user-supplied CSV data and review the permissions granted to the Pyodide execution context, since this bug proves a code blocklist alone is not a reliable security boundary for LLM-generated code.

Is CVE-2026-70477 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-70477, increasing the risk of exploitation.

How to fix CVE-2026-70477?

1) Upgrade Flowise and flowise-components to 3.1.3 or later immediately — this is the primary and complete fix. 2) Until patched, disable or restrict the CSV Agent node in any chatflow that processes external, user-uploaded, or otherwise untrusted CSV data. 3) Run Flowise's Pyodide execution context with least-privilege service account credentials and no access to secrets/environment variables it doesn't need, since blocklist validators should not be treated as a hard security boundary. 4) Add egress/network restrictions around the Flowise host to limit lateral movement if code execution occurs. 5) Monitor Flowise application logs and chatflow execution history for anomalous generated Python (e.g., import statements for os, subprocess, socket, or attempts to access the filesystem outside the expected DataFrame scope). 6) Review the GHSA-5xvg-pmgg-3mxr advisory and commit f4e2794 to understand the exact validator bypass pattern for detection engineering.

What systems are affected by CVE-2026-70477?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code/no-code AI builders, code interpreter / code execution tools, data analysis agents.

What is the CVSS score for CVE-2026-70477?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworkslow-code/no-code AI builderscode interpreter / code execution toolsdata analysis agents

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0051.001 Indirect

AML.T0053 AI Agent Tool Invocation

AML.T0102 Generate Malicious Commands

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM01, LLM02

What are the technical details?

Original Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist validator and executes in an unsandboxed Pyodide environment. The specific flaw exists within the run method of the CSV_Agents class, where untrusted data is used to construct an LLM prompt and the resulting pythonCode is validated by validatePythonCodeForDataFrame before execution. An attacker can leverage this to execute arbitrary code in the context of the service account. This issue is fixed in 3.1.3.

Exploitation Scenario

An attacker with access to a Flowise chatflow that exposes a CSV Agent node — for example, a customer-facing 'upload your data and ask questions' chatbot — uploads or references a CSV file containing crafted content designed to prompt-inject the underlying LLM. The injected instructions cause the LLM to draft Python code that, while superficially avoiding blocklisted keywords/patterns, still achieves code execution (e.g., via obfuscated imports or indirect references) once it passes validatePythonCodeForDataFrame. The CSV_Agents class executes that pythonCode inside the Pyodide interpreter without additional sandboxing, and the attacker's code runs with the privileges of the Flowise service account — enabling data exfiltration from the host, credential theft from environment variables, or a pivot point into the broader network.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.