Flowise EUVD-2026-52745

Requires an authenticated Flowise account able to create or run a chatflow that uses the CSV Agent node (the exploit log shows an 'Authentication successful' step and creation of a chatflow before payload delivery); the CSV Agent feature must be reachable. The injected data-URI base64 string must contain no commas, because csvFile.split(',') splits the payload on every comma - the documented payload works around this. Exploitation is limited by the need for valid credentials (PR:L, not unauthenticated) and by the target running the vulnerable CSV Agent code path in flowise/flowise-components <= 3.1.2; impact is maximized when Flowise runs as root in a container, which is the common default.

The reported CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9 Critical) is consistent with the described attack: network-reachable, low complexity, requiring only low-privilege authentication, with a scope change reflecting the Pyodide-sandbox-to-host escape and full CIA impact. Real-world risk is high because publicly available exploit code exists (a Metasploit module, flowise_csv_agent_rce, and a demonstrated root Meterpreter session on Flowise 3.1.2), the process runs as root/PID 1 in typical container deployments, and a vendor patch is available so the details are public. The main limiting factor is the PR:L authentication requirement - an attacker needs valid credentials (or an unauthenticated/weakly-authenticated Flowise instance) to create the malicious chatflow. No EPSS score and no CISA KEV entry were provided; absence from KEV means active in-the-wild exploitation is not confirmed, so prioritization should rest on the confirmed POC plus the trivial post-auth exploitability rather than on KEV/EPSS signals, which are missing here.

An authenticated Flowise user uploads a crafted CSV data URI to a CSV Agent chatflow whose base64 payload breaks out of the Python string and imports the js bridge to reach the host process. Because attack complexity is low (AC:L) and only low privileges are required (PR:L), the injected command runs as root in the container, giving the attacker a reverse shell. A public Metasploit module (flowise_csv_agent_rce) automates the whole chain to a root Meterpreter session.