CVE-2026-69256

Flowise CSVAgent insecure deserialization allows remote code execution.

• CVSS 9.4
• 94
• Input Validation and Sanitization
• Remote

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/<UUID> to execute commands. This issue is fixed in version 3.1.3.

CVE

CVE-2026-69256

CWE

94

CVSS base score

9.4

Published

2026-08-04

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Flowise

Solution

Upgrade Flowise to version 3.1.3 or later.

import pandas as pd
import io

def load_csv_agent_data(custom_read_func: str, data_path: str):
    """
    Loads data for a CSV agent using a custom user-supplied pandas function.
    This is a Python analogue for the vulnerable component in Flowise.
    """

    # The execution context provides pandas as 'pd' and the io module.
    execution_context = {
        "pd": pd,
        "io": io,
        "data_path": data_path
    }

    # VULNERABLE: User input is formatted into a string and executed, allowing calls to dangerous functions like read_pickle.
    df = eval(f"pd.{custom_read_func}", execution_context)

    # ... further agent processing ...
    return df

import pandas as pd
import io

def load_csv_agent_data(custom_read_func: str, data_path: str):
    """
    Loads data for a CSV agent using a custom user-supplied pandas function.
    This is a Python analogue for the vulnerable component in Flowise.
    """
    denylist = [
        'read_pickle'
    ]
    # FIX: The user-supplied function name is validated against a denylist before execution.
    func_name = custom_read_func.split('(')[0].strip()
    if func_name in denylist:
        raise ValueError(f"Disallowed function: {func_name}")

    # The execution context provides pandas as 'pd' and the io module.
    execution_context = {
        "pd": pd,
        "io": io,
        "data_path": data_path
    }

    df = eval(f"pd.{custom_read_func}", execution_context)

    # ... further agent processing ...
    return df

{
    "filepath_or_buffer": "data:application/octet-stream;base64,gASVIwAAAAAAAABKCF9fbWFpbl9flEMAUkNFLZSTlCkBhpRKBnBvc2l4lEAGc3lzdGVtlJOUlEhpZCA+IC90bXAvcHduZWSUhZRSlC4="
}

@misc{vaitp:cve202669256,
  title        = {{Flowise CSVAgent insecure deserialization allows remote code execution.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-69256},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-69256/}}
}