Which versions of Flowise are affected by CVE-2026-41137?

FlowiseAI Flowise versions prior to 3.1.0 contain a critical remote code execution vulnerability in the CSVAgent node that allows authenticated attackers to execute arbitrary commands on the server.. A patch is available.

How to fix or mitigate CVE-2026-41137?

Within 24 hours: inventory all Flowise instances and verify that FLOWISE_USERNAME and FLOWISE_PASSWORD environment variables are set (leaving them unset enables unauthenticated bypass via internal header spoofing). Within 7 days: upgrade FlowiseAI Flowise and flowise-components to version 3.1.0 or later across all production and staging environments; test CSVAgent workflows in staging before production cutover to confirm compatibility. Within 30 days: review application logs and Flowise usage telemetry for suspicious CSVAgent node access patterns, and audit downstream systems that receive Flowise workflow outputs to identify potential data exfiltration or lateral movement.

Flowise CVE-2026-41137

Q: What is the CVSS score of CVE-2026-41137?

CVE-2026-41137 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-25277 CRITICAL

Code Injection (CWE-94)

2026-04-23 GitHub_M

GHSA-9wc7-mj3f-74xv

RCE Command Injection Code Injection Flowise Flowise Components Flowiseai

9.4

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-reachable API with low-complexity injection needs only low-privileged auth (PR:L, or bypassable), no UI; code escapes the pyodide context to run OS commands, so S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 04:34 vuln.today

Analysis Generated

Jul 24, 2026 - 04:34 vuln.today

Patch released

Apr 24, 2026 - 15:15 nvd

Patch available

Apr 23, 2026 - 21:01 EUVD

CVSS changed

Apr 23, 2026 - 20:26 NVD

9.4 (CRITICAL)

EUVD ID Assigned

Apr 23, 2026 - 20:00 euvd

EUVD-2026-25277

CVE Published

Apr 23, 2026 - 19:10 nvd

CRITICAL 9.4

DescriptionGitHub Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and executed by the server. This vulnerability is fixed in 3.1.0.

AnalysisAI

Authenticated remote code execution in FlowiseAI Flowise (and the flowise-components package) prior to 3.1.0 arises from the CSVAgent node, which interpolates a user-supplied 'customReadCSV' Pandas string directly into Python code executed via pyodide. An authenticated attacker (or an unauthenticated one when FLOWISE_USERNAME/FLOWISE_PASSWORD are unset, via the 'x-request-from: internal' header bypass) can inject Python such as 'import os;os.system(...)' to run arbitrary commands on the server. Publicly available exploit code exists (PoC in the GHSA advisory); this is not listed in CISA KEV, and EPSS is modest at 0.62% (70th percentile).

Technical ContextAI

Flowise is a low-code, drag-and-drop builder for LLM/agent workflows built in TypeScript/Node.js. The flaw sits in packages/components CSVAgent.ts (around line 157), where the user-controlled 'customReadCSVFunc' is string-interpolated into a 'code' variable that is then passed to 'pyodide.runPythonAsync(code)'. This is a textbook CWE-94 (Improper Control of Generation of Code / code injection): rather than validating that the input is only a Pandas read expression, the server concatenates attacker text into executable Python, so a payload like 'DataFrame({'foo':['bar!']});import os;os.system('whoami')' is executed. The affected CPEs are cpe:2.3:a:flowiseai:flowise and cpe:2.3:a:flowiseai:flowise-components. Exploitation involves the REST API: POST /api/v1/chatflows to create a flow containing only the CSVAgent node, then POST /api/v1/prediction/[chatflowId] to trigger execution.

RemediationAI

Vendor-released patch: upgrade Flowise and flowise-components to 3.1.0 or later (npm install flowise@3.1.0 / flowise-components@3.1.0), which fixes the CSVAgent interpolation; see the advisory at https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9wc7-mj3f-74xv. If you cannot patch immediately, set strong FLOWISE_USERNAME and FLOWISE_PASSWORD so the 'x-request-from: internal' header cannot bypass authentication (note this only limits, not eliminates, risk since authenticated users can still exploit it), and avoid deploying or restrict the CSVAgent node in production flows. Additionally place Flowise behind a reverse proxy/VPN or network ACLs so the /api/v1/chatflows and /api/v1/prediction endpoints are not reachable from untrusted networks, and monitor for unexpected chatflow creation or process spawns from the Node.js/pyodide runtime; the trade-off of blocking those endpoints is loss of programmatic flow creation for legitimate automation.