CVE-2026-69255
Received Received - Intake

Code Injection in Flowise AI Agent via CSV Processing

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split(',').pop() and interpolated it directly into executable Python as base64_string = "${base64String}" before calling Pyodide. The validatePythonCodeForDataFrame() denylist only checked later LLM-generated code and did not validate this initial code block. An authenticated attacker could inject a closing quote followed by Python code, use Pyodide's js bridge to load Node.js child_process, and execute arbitrary operating system commands as root in the Flowise container. This issue is fixed in version 3.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-69255
EUVD
EUVD-2026-52745

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
flowise flowise 3.1.3
flowiseai flowise to 3.1.3 (exc)
flowiseai flowise to 3.1.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-69255 is a critical remote code execution (RCE) vulnerability in Flowise versions 3.1.2 and earlier. It affects the CSV Agent component, allowing attackers to inject malicious Python code via a base64-encoded string in a data URI. The vulnerability stems from unsanitized string extraction and direct interpolation of user-controlled input into executable Python code without proper validation.

Detection Guidance

Check for Flowise versions 3.1.2 or earlier. Inspect running processes for unexpected Python or Node.js child_process activity. Look for unauthorized network connections or reverse shells originating from Flowise containers.

Impact Analysis

An attacker could execute arbitrary operating system commands as root in the Flowise container. This could lead to credential theft, arbitrary file reads, and denial-of-service conditions. Exploitation does not require authentication and can be performed remotely with low complexity.

Mitigation Strategies

Upgrade Flowise to version 3.1.3 or later. Remove CSVAgent and AirtableAgent components if present. Disable vulnerable components until patched. Monitor for suspicious activity in Flowise logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69255. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart