EUVD-2026-52801
GHSA-4j8x-x6v7-w9rq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity code injection; PR:L reflects the workspace write access needed to plant the node, and S:C captures the Python-to-Node host escape yielding full host RCE.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import, the attacker can break out of the Python string literal, hand a JavaScript string to js.eval, dynamically import Node built-in modules such as fs and child_process, and execute arbitrary file I/O or OS commands as the Flowise process. The two validator paths around this code, validatePythonCodeForDataFrame and validateCustomReadCSVFunction, are never applied to the bootstrap template. A workspace user with chatflows:create or agentflows/chatflows update permission can plant a CSV Agent node with a crafted csvFile; once the chatflow is exposed via POST /api/v1/prediction/:id, any unauthenticated request triggers host remote code execution. This issue is fixed in version 3.1.3.
Articles & Coverage 1
AnalysisAI
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise process by abusing the CSVAgent node, which interpolates an attacker-controlled base64 segment of the csvFile data URI directly into a Python template run by Pyodide. Because Pyodide's default js bridge exposes globalThis (including eval and dynamic import on Node.js), the injected code can break out of the Python string, call js.eval, import fs and child_process, and run host commands; the surrounding validators are never applied to this bootstrap template. A low-privileged workspace user plants the malicious node, after which any unauthenticated request to the public POST /api/v1/prediction/:id endpoint triggers the RCE. No public exploit is identified at time of analysis (no KEV, no POC signal in the provided data), but the fix is confirmed in version 3.1.3.
Technical ContextAI
Flowise is a low-code/no-code visual builder for LLM orchestration flows (chatflows and agentflows) built on Node.js with the LangChain ecosystem. The affected component is the CSVAgent node in packages/components/nodes/agents/CSVAgent/CSVAgent.ts, which uses Pyodide (a WebAssembly build of CPython) to run pandas against uploaded CSV data. The vulnerability is CWE-94 (Improper Control of Generation of Code, i.e. code injection): the run() method splits the csvFile data URI on commas, pops the base64 segment, and interpolates it verbatim into a Python source string (base64_string = "${base64String}") that is then passed to pyodide.runPythonAsync. Because Pyodide is initialized with its default js bridge to globalThis and Node.js exposes eval and dynamic import() there, an attacker who breaks out of the Python string literal can pivot from the Python sandbox into the Node host via js.eval and import Node built-in modules such as fs and child_process. The existing guardrails validatePythonCodeForDataFrame and validateCustomReadCSVFunction only inspect the customReadCSV field and unrelated python code, never the interpolated base64String, so the sink is completely unguarded. Affected packages per the advisory are npm/flowise and npm/flowise-components at versions <= 3.1.2.
RemediationAI
Upgrade to Flowise 3.1.3, which contains the fix (Vendor-released patch: 3.1.3; see https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3, PR https://github.com/FlowiseAI/Flowise/pull/6499 and commit f4e2794f6a576b94578f2fdafbf49c2fb304626c, advisory GHSA-4j8x-x6v7-w9rq); upgrade both flowise and flowise-components together. If you cannot patch immediately, restrict who holds chatflows:create and agentflows/chatflows update permissions to fully trusted operators only, since planting the malicious node requires that privilege - the trade-off is reduced self-service flow editing for workspace users. Additionally, avoid exposing or disable the public POST /api/v1/prediction/:id endpoint for untrusted callers (e.g. place it behind authentication or network restrictions), accepting that this breaks unauthenticated/embedded prediction consumers. Where feasible, avoid using the deprecated CSV Agent node entirely and audit existing chatflows for CSV Agent nodes with unexpected csvFile contents. Note the PR also removes related deprecated Python/Pyodide agent nodes (e.g. AirtableAgent), so review flows that depend on them before upgrading.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today