Flowise CVE-2026-69264

Exploitation requires two things: (1) an attacker with a workspace account holding chatflows:create or any agentflows/chatflows update permission to plant a CSV Agent node containing a crafted csvFile data URI whose base64 segment escapes the Python string literal; and (2) that chatflow being reachable via the whitelisted POST /api/v1/prediction/:id prediction endpoint, whose invocation is unauthenticated. The vulnerable feature is specifically the CSVAgent node's Pyodide bootstrap template, and the environment must be Node.js-based Flowise <= 3.1.2 where Pyodide's default js bridge exposes globalThis (eval and dynamic import). Limiting factors: an attacker needs low-level authenticated write access to flows to plant the node (not fully anonymous end-to-end), so single-operator or tightly-permissioned instances are far less exposed than multi-tenant deployments with many flow editors; there is no user-interaction requirement once the node is planted.

This is a genuine high-priority issue rather than an inflated high-CVSS score. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with high vulnerable- and subsequent-system C/I/A, score 9.4) aligns with the described mechanics: network reachable, low attacker complexity, and full host compromise. The PR:L in the vector reflects the planting step, which requires a low-privileged workspace user with chatflows/agentflows create-or-update permission; however, the described trigger - any unauthenticated request to the whitelisted POST /api/v1/prediction/:id endpoint - means the effective barrier once a node is planted is very low, which the subsequent-system impact (SC/SI/SA:H) captures. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from signals; there is no public exploit identified at time of analysis. The main real-world limiter is the initial-access requirement of an authenticated workspace user in a multi-tenant deployment, so risk is highest where untrusted or numerous users hold flow-editing permissions, or where a single-tenant instance's builder is exposed. Note the two signals to reconcile: CVSS PR:L (needs some privilege to plant) versus the description's emphasis that the eventual prediction call is unauthenticated - both are true because they describe different stages of the attack chain.

A low-privileged member of a shared Flowise workspace creates or edits a chatflow, adds a CSV Agent node, and sets its csvFile to a data URI whose base64 segment is crafted to break out of the Python string and call js.eval to import Node's child_process. They (or any anonymous third party) then send a normal request to the public POST /api/v1/prediction/:id for that chatflow, and Flowise executes attacker-chosen OS commands on the host as the Flowise process. No public exploit code is identified at time of analysis, but the attack is low-complexity per the CVSS vector.