Remote code execution in Flowise CSVAgent via unsanitized csvFile interpolation (CVE-2026-69264)

Flowise's CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template executed by Pyodide without any content validation. Because Pyodide's default js bridge exposes Node.js globals including eval and dynamic import, an attacker can escape the Python string literal and execute arbitrary file I/O or OS commands as the Flowise process. A workspace user with chatflow creation or update permissions can plant a malicious CSV Agent node, and once the chatflow is published, any unauthenticated request to the public prediction endpoint triggers host-level remote code execution. Public POC available. Affected versions: - <= 3.1.2 We recommend updating to: 3.1.3. CVSS 9.4 · our assessment: act_now Reference: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4j8x-x6v7-w9rq Details: https://vuln.today/cve/CVE-2026-69264