Code injection in Flowise CSV Agent customReadCSV parameter (CVE-2026-73486)

Flowise contains a code injection vulnerability in the CSV Agent node's `customReadCSV` parameter, where user-supplied input is substituted directly into a Python script prior to execution in an unsandboxed pyodide environment. The validator intended to block dangerous input relies on a static regex blocklist that can be bypassed through obfuscation, allowing authenticated remote attackers to execute arbitrary code in the context of the user running the Flowise server. Affected versions: - npm flowise <= 3.1.2 - npm flowise-components <= 3.1.2 We recommend updating to: 3.1.3. CVSS 9.0 · our assessment: act_now Reference: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4878-cqgq-j53v Details: https://vuln.today/cve/CVE-2026-73486