CVE-2026-69256
Received Received - Intake

Code Execution via CSVAgent in Flowise

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/<UUID> to execute commands. This issue is fixed in version 3.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-69256
EUVD
EUVD-2026-52746

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
flowiseai flowise to 3.1.3 (exc)
flowiseai flowise 3.1.3
flowiseai flowise-components to 3.1.3 (exc)
flowiseai flowise-components 3.1.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a remote code execution (RCE) flaw in Flowise's CSV Agent node. It allowed authenticated users to execute arbitrary Python code via Pyodide by exploiting a gap in input validation. The denylist blocking dangerous constructs missed pandas.read_pickle(), enabling attackers to deserialize malicious pickle payloads and run OS commands. The issue was fixed in version 3.1.3 with stricter allowlists and denylists.

Detection Guidance

Check Flowise versions below 3.1.3 for the vulnerable CSVAgent node. Inspect logs for suspicious API calls to /api/v1/prediction/<UUID> with customReadCSVFunc parameters containing read_pickle or similar payloads.

Impact Analysis

An attacker with authenticated access could create or modify a chatflow, inject a malicious payload via the CSV Agent node, and execute arbitrary commands on the server. This could lead to full system compromise, data theft, or unauthorized access. The high CVSS score (9.4) reflects its severe impact on confidentiality, integrity, and availability.

Compliance Impact

This RCE vulnerability could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using vulnerable versions risk non-compliance, potential fines, and reputational damage due to compromised sensitive data.

Mitigation Strategies

Upgrade Flowise and flowise-components to version 3.1.3 or later. Restrict access to the CSVAgent node configuration and API endpoints. Monitor for unauthorized chatflow modifications or prediction requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69256. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart