Executive brief
FlowiseAI Flowise is an open-source low-code platform that allows developers to build AI agents and chatflows with a visual editor. The CSV Agent node in Flowise processes user queries against CSV files by generating Python code via an LLM, but insufficient input validation of this code allows attackers to bypass security filters and execute arbitrary operating system commands on the server without authentication. Successful exploitation could compromise the entire server and any data it processes.
Technical details
This vulnerability exists in the CSV Agent node's run method within the CSVAgent class. The vulnerability stems from incomplete regex-based validation of LLM-generated Python code before execution in a Pyodide environment. The validatePythonCodeForDataFrame() function attempts to block dangerous imports and functions using regex patterns (e.g., /\bimport\s+(?!pandas|numpy\b)/g), but these patterns can be bypassed through prompt injection techniques. For example, an attacker can craft a prompt that tricks the LLM into generating code like "import pandas as np, os as pandas" which imports the os module while appearing to only use pandas. The attacker can then invoke OS commands via the pandas alias (e.g., pandas.system("xcalc")). An unauthenticated attacker with the ability to submit prompts to a chatflow can exploit this via prompt injection, while an authenticated attacker could specify a malicious server to provide pre-crafted malicious scripts. The vulnerability affects Flowise versions up to 3.0.13 and was patched in 3.1.0.
Affected products
- FlowiseAI Flowise <=3.0.13
- FlowiseAI flowise-components <=3.0.13
Timeline
- 2026-04-21: disclosed: Vulnerability published by Trend Micro Zero Day Initiative
- 2026: patched: Fixed in version 3.1.0