CVE-2026-69255
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split(',').pop() and interpolated it directly into executable Python as base64_string = "${base64String}" before calling Pyodide. The validatePythonCodeForDataFrame() denylist only checked later LLM-generated code and did not validate this initial code block. An authenticated attacker could inject a closing quote followed by Python code, use Pyodide's js bridge to load Node.js child_process, and execute arbitrary operating system commands as root in the Flowise container. This issue is fixed in version 3.1.3.
Summary dbcve.org
In Flowise before version 3.1.3, the CSVAgent extracts CSV data using file.split(',').pop() and directly interpolates it into Python code as base64_string = "${base64String}" before executing via Pyodide. The validatePythonCodeForDataFrame() denylist only validated LLM-generated code, not this initial code block. An authenticated attacker can inject a closing quote followed by Python code, leveraging Pyodide's JS bridge to load Node.js child_process and execute arbitrary OS commands as root.
Mitigation
Upgrade Flowise to version 3.1.3 or later. If immediate upgrade is not possible, restrict access to authenticated users only and monitor for suspicious CSV uploads containing quote characters followed by Python code.