CVE-2026-73486: Flowise CSV Agent code injection

CISO Take

Flowise's CSV Agent node lets a low-code AI workflow read and process CSV files using an embedded, unsandboxed Python interpreter (pyodide) — and versions before 3.1.3 fail to properly block malicious code smuggled into the customReadCSV parameter, since the validator relies on a static regex blocklist that obfuscation easily defeats. Any authenticated Flowise user, even one with minimal privileges, can therefore run arbitrary Python with full system access, turning a workflow-building feature into a straight path to host compromise — a serious blast radius given Flowise sits at the center of many low-code agent deployments. Exploitation currently requires authentication and there's no public PoC, KEV listing, or Nuclei template, and EPSS sits at a modest 0.33% (top 74th percentile), which is why CISA's SSVC lands on ATTEND rather than ACT — but insider threats, compromised low-privilege accounts, or multi-tenant Flowise instances make this more dangerous than the score alone suggests. Patch to Flowise 3.1.3 immediately; until then, restrict who can create or edit flows with the CSV Agent node and treat the pyodide execution environment as untrusted by running Flowise on an isolated host with no access to sensitive credentials or internal networks. Monitor for anomalous outbound connections or process spawning from the Flowise host, since a regex-only blocklist should never be treated as a real security boundary.

Sources:NVDEPSSGitHub Advisoryvulncheck.comATLASCISA SSVC

What is the risk?

Moderate-to-high technical severity (arbitrary code execution with full system privileges) but tempered by exploitation prerequisites: authentication is required and no CVSS score, public exploit, or KEV entry currently exists, keeping EPSS low (0.33%, 74th percentile) and CISA's SSVC verdict at ATTEND. The real risk driver is trust-boundary design — Flowise environments are often multi-tenant or shared among teams, so 'authenticated' does not mean 'trusted,' and the flawed regex blocklist offers essentially no defense against a motivated internal or semi-privileged attacker. Because the unsandboxed pyodide environment grants full system access, successful exploitation escalates directly to host compromise with no additional chaining required.

How does the attack unfold?

Authenticated Access

Attacker obtains or already holds a low-privilege, authenticated account on a Flowise instance.

AML.T0012

Malicious CSV Agent Configuration

Attacker creates or edits a flow using the CSV Agent node and crafts an obfuscated Python payload in the customReadCSV parameter to bypass the static regex blocklist.

AML.T0053

Unsandboxed Code Execution

The obfuscated payload executes as arbitrary Python code inside the unsandboxed pyodide runtime.

AML.T0050

Full System Compromise

With pyodide granting full system access, the attacker achieves host-level compromise and can harvest credentials or pivot further into the environment.

AML.T0112

Authenticated Access

Attacker obtains or already holds a low-privilege, authenticated account on a Flowise instance.

AML.T0012

Malicious CSV Agent Configuration

Attacker creates or edits a flow using the CSV Agent node and crafts an obfuscated Python payload in the customReadCSV parameter to bypass the static regex blocklist.

AML.T0053

Unsandboxed Code Execution

The obfuscated payload executes as arbitrary Python code inside the unsandboxed pyodide runtime.

AML.T0050

Full System Compromise

With pyodide granting full system access, the attacker achieves host-level compromise and can harvest credentials or pivot further into the environment.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.7%

chance of exploitation in 30 days

Higher than 52% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

Upgrade to Flowise 3.1.3 or later immediately, which fixes the customReadCSV validation. Until patched, disable or restrict access to the CSV Agent node for all but fully-trusted administrators, and audit existing flows for use of customReadCSV. Do not rely on the regex blocklist as a security control — treat any pyodide/Python execution surface in Flowise as equivalent to full shell access and run Flowise in an isolated environment (dedicated VM/container, no access to production credentials, secrets, or internal network segments). Add detection for anomalous process execution, outbound network connections, or file system access originating from the Flowise host, and review authentication/authorization on who can create or modify flows.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionData LeakageAgentPluginFrameworkAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation AML.T0112- Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system security

NIST AI RMF

MEASURE 2.7-AI system security and resilience evaluated

OWASP LLM Top 10

LLM07-Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-73486?

Flowise's CSV Agent node lets a low-code AI workflow read and process CSV files using an embedded, unsandboxed Python interpreter (pyodide) — and versions before 3.1.3 fail to properly block malicious code smuggled into the customReadCSV parameter, since the validator relies on a static regex blocklist that obfuscation easily defeats. Any authenticated Flowise user, even one with minimal privileges, can therefore run arbitrary Python with full system access, turning a workflow-building feature into a straight path to host compromise — a serious blast radius given Flowise sits at the center of many low-code agent deployments. Exploitation currently requires authentication and there's no public PoC, KEV listing, or Nuclei template, and EPSS sits at a modest 0.33% (top 74th percentile), which is why CISA's SSVC lands on ATTEND rather than ACT — but insider threats, compromised low-privilege accounts, or multi-tenant Flowise instances make this more dangerous than the score alone suggests. Patch to Flowise 3.1.3 immediately; until then, restrict who can create or edit flows with the CSV Agent node and treat the pyodide execution environment as untrusted by running Flowise on an isolated host with no access to sensitive credentials or internal networks. Monitor for anomalous outbound connections or process spawning from the Flowise host, since a regex-only blocklist should never be treated as a real security boundary.

Is CVE-2026-73486 actively exploited?

No confirmed active exploitation of CVE-2026-73486 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-73486?

Upgrade to Flowise 3.1.3 or later immediately, which fixes the customReadCSV validation. Until patched, disable or restrict access to the CSV Agent node for all but fully-trusted administrators, and audit existing flows for use of customReadCSV. Do not rely on the regex blocklist as a security control — treat any pyodide/Python execution surface in Flowise as equivalent to full shell access and run Flowise in an isolated environment (dedicated VM/container, no access to production credentials, secrets, or internal network segments). Add detection for anomalous process execution, outbound network connections, or file system access originating from the Flowise host, and review authentication/authorization on who can create or modify flows.

What systems are affected by CVE-2026-73486?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code AI orchestration, data processing pipelines.

What is the CVSS score for CVE-2026-73486?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworkslow-code AI orchestrationdata processing pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

AML.T0112Machine Compromise

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to execute code in the unsandboxed pyodide environment with full system access.

Exploitation Scenario

A contractor or lower-privileged employee with legitimate but limited access to a shared Flowise instance creates a new flow and adds a CSV Agent node. Instead of a normal CSV file path, they craft an obfuscated Python payload for the customReadCSV parameter — using string concatenation, encoding, or alternate syntax to slip past the static regex blocklist — that, when executed in the unsandboxed pyodide runtime, spawns a reverse shell or reads local files. Because pyodide has full system access rather than being isolated, the attacker immediately gains code execution on the underlying host, from which they can harvest environment variables, API keys, or database credentials used by other flows and pivot further into the internal network.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.