Flowise CVE-2026-73486

Exploitation requires an authenticated Flowise account with permission to create or modify a chatflow that uses the CSV Agent node, and the ability to set that node's customReadCSV parameter (CVSS PR:L confirms low-privilege authentication is needed; UI:N means no victim interaction is required once the attacker triggers the node). The specific limiting factor is the AC:H obfuscation requirement - the attacker must craft input that evades the static regex blocklist rather than submit plain Python - and access to the CSV Agent node feature itself; instances that do not expose chatflow-editing to untrusted users, or that are network-restricted, materially reduce reachability. The impact hinges on the deployment shipping the unsandboxed pyodide runtime, which the advisory states is the default.

The signals are mostly consistent and point to a genuine high-severity issue for exposed instances: the CVSS 4.0 vector (AV:N/AC:H/PR:L/UI:N with high vulnerable- and subsequent-system impact, base 9.0) reflects network reach, low-privilege authentication, no user interaction, and a scope-crossing impact into the host. The one moderating factor is AC:H, which aligns with the description's requirement to craft an obfuscation payload that defeats the regex denylist - meaning exploitation is reliable for a knowledgeable attacker but not trivially point-and-click. Because the CSV Agent node is a normal product feature, a mid-sized operator running Flowise for internal AI tooling should treat any authenticated user (or any compromised low-privilege account) as a potential path to full server compromise, and prioritize the 3.1.3 upgrade regardless of perimeter posture. There is no KEV listing and no EPSS score supplied, and no public POC is referenced, so real-world exploitation should currently be judged as plausible-but-unproven rather than active; the disclosure by VulnCheck plus a published GitHub Security Advisory raises the likelihood that working exploits appear, so patching should not be deferred on the basis of missing EPSS/KEV data alone.

An attacker with a low-privilege Flowise account (or a phished/compromised builder credential) opens or creates a chatflow, adds or edits a CSV Agent node, and supplies an obfuscated Python payload in customReadCSV that slips past the regex denylist. When the node runs, the code executes in the unsandboxed pyodide environment and gains full access to the underlying host, enabling data theft, lateral movement, or persistence. No public POC is referenced, but the AC:H obfuscation technique is well understood for denylist bypasses.