Remote code execution via pickle deserialization in Flowise CSVAgent (CVE-2026-69256)

The CSVAgent node in Flowise passes user-supplied input directly into a Python code template executed via pyodide, relying on a denylist to block dangerous constructs. An attacker can bypass this denylist by invoking `pandas.read_pickle()` with a crafted pickled payload, achieving arbitrary code execution on the server. Any user with access to the Flowise dashboard who can create or modify a Chatflow can exploit this vulnerability. Public POC available. Affected versions: - npm flowise <= 3.1.2 - npm flowise-components <= 3.1.2 We recommend updating to: npm flowise 3.1.3, npm flowise-components 3.1.3. CVSS 9.4 · our assessment: act_now Reference: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x6vm-w76m-8j7g Details: https://vuln.today/cve/CVE-2026-69256