CVE-2026-69255

Flowise CSVAgent allows RCE via Python code injection in CSV files.

• CVSS 9.2
• 94
• Input Validation and Sanitization
• Remote

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split(',').pop() and interpolated it directly into executable Python as base64_string = "${base64String}" before calling Pyodide. The validatePythonCodeForDataFrame() denylist only checked later LLM-generated code and did not validate this initial code block. An authenticated attacker could inject a closing quote followed by Python code, use Pyodide's js bridge to load Node.js child_process, and execute arbitrary operating system commands as root in the Flowise container. This issue is fixed in version 3.1.3.

CVE

CVE-2026-69255

CWE

94

CVSS base score

9.2

Published

2026-08-04

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Flowise

Fixed by upgrading

Yes

Solution

Upgrade to Flowise version 3.1.3 or later.

class CSVAgent:
    def _get_pyodide_code(self, file_content: str) -> str:
        # Simulate extracting the base64 data from a data URI.
        # The real vulnerability was in TS: file.split(',').pop()
        try:
            base64_string = file_content.split(',')[1]
        except IndexError:
            base64_string = ""

        # The validatePythonCodeForDataFrame() function was not called on this
        # initial code, only on later LLM-generated code.

        # VULNERABLE: The extracted string is directly interpolated into the Python code block,
        # allowing an attacker to inject code by closing the string literal.
        python_code = f"""
import pandas as pd
import base64
from io import StringIO

base64_string = "{base64_string}"
decoded_data = base64.b64decode(base64_string)
csv_file = StringIO(decoded_data.decode('utf-8'))
df = pd.read_csv(csv_file)
# ... more code to process df would follow
"""
        return python_code

import json

class CSVAgent:
    def _get_pyodide_code(self, file_content: str) -> str:
        # Simulate extracting the base64 data from a data URI.
        # The real vulnerability was in TS: file.split(',').pop()
        try:
            base64_string = file_content.split(',')[1]
        except IndexError:
            base64_string = ""

        # The validatePythonCodeForDataFrame() function was not called on this
        # initial code, only on later LLM-generated code.

        # FIX: The string is serialized using json.dumps() to ensure it is treated
        # as a single, safe string literal within the generated Python code.
        python_code = f"""
import pandas as pd
import base64
from io import StringIO

base64_string = {json.dumps(base64_string)}
decoded_data = base64.b64decode(base64_string)
csv_file = StringIO(decoded_data.decode('utf-8'))
df = pd.read_csv(csv_file)
# ... more code to process df would follow
"""
        return python_code

data:text/csv;base64,,"\nimport js\njs.require('child_process').execSync('touch /tmp/pwned')\n#

@misc{vaitp:cve202669255,
  title        = {{Flowise CSVAgent allows RCE via Python code injection in CSV files.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-69255},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-69255/}}
}