# CVE-2026-41264: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Source: https://junglewise.ai/threats/cve-2026-41264-flowise-csv-agent-prompt-injection-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-41264 · Severity: critical · CVSS 9.8 · Published 2026-04-23

FlowiseAI Flowise is an open-source low-code platform that allows developers to build AI agents and chatflows with a visual editor. The CSV Agent node in Flowise processes user queries against CSV files by generating Python code via an LLM, but insufficient input validation of this code allows attackers to bypass security filters and execute arbitrary operating system commands on the server without authentication. Successful exploitation could compromise the entire server and any data it processes.

Technologies: [FlowiseAI Flowise](https://junglewise.ai/threats/technologies/flowiseai-flowise), [flowise (npm)](https://junglewise.ai/threats/technologies/flowise), [flowise-components (npm)](https://junglewise.ai/threats/technologies/flowise-components). Vendors: [FlowiseAI](https://junglewise.ai/threats/vendors/flowiseai), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-41264 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41264 being exploited in the wild.

**How severe is CVE-2026-41264?** Critical severity, with a CVSS score of 9.8, published 23 April 2026.

**Which products and versions are affected?** flowise (npm) <= 3.0.13, SEMVER:introduced=0,fixed=3.1.0; flowise-components (npm) <= 3.0.13, SEMVER:introduced=0,fixed=3.1.0.

**Is there a fix for CVE-2026-41264?** Yes. flowise (npm): upgrade to 3.1.0 or later; flowise-components (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41264 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41264?** Check whether you run FlowiseAI Flowise, flowise (npm) or flowise-components (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- flowise (npm): upgrade to 3.1.0 or later

  ```sh
  npm install flowise@3.1.0
  ```

- flowise-components (npm): upgrade to 3.1.0 or later

  ```sh
  npm install flowise-components@3.1.0
  ```


## Technical details

This vulnerability exists in the CSV Agent node's run method within the CSVAgent class. The vulnerability stems from incomplete regex-based validation of LLM-generated Python code before execution in a Pyodide environment. The validatePythonCodeForDataFrame() function attempts to block dangerous imports and functions using regex patterns (e.g., /\bimport\s+(?!pandas|numpy\b)/g), but these patterns can be bypassed through prompt injection techniques. For example, an attacker can craft a prompt that tricks the LLM into generating code like "import pandas as np, os as pandas" which imports the os module while appearing to only use pandas. The attacker can then invoke OS commands via the pandas alias (e.g., pandas.system("xcalc")). An unauthenticated attacker with the ability to submit prompts to a chatflow can exploit this via prompt injection, while an authenticated attacker could specify a malicious server to provide pre-crafted malicious scripts. The vulnerability affects Flowise versions up to 3.0.13 and was patched in 3.1.0.

## Affected products

- FlowiseAI Flowise <=3.0.13
- FlowiseAI flowise-components <=3.0.13

## Identifiers

- CVE-2026-41264
- GHSA-3hjv-c53m-58jj

## Timeline

- 2026-04-21: disclosed: Vulnerability published by Trend Micro Zero Day Initiative
- 2026: patched: Fixed in version 3.1.0

## References

- [https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3hjv-c53m-58jj](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3hjv-c53m-58jj)
- [https://github.com/FlowiseAI/Flowise](https://github.com/FlowiseAI/Flowise)

## Related threats

- [Flowise sandbox escape in custom function endpoint](https://junglewise.ai/threats/cve-2026-119978-flowise-through-3-1-4-contains-a-sandbox-escape-vulnerability)
- [Duplicate Advisory: INVITED users auto-promoted via SSO email match (invite-token bypass)](https://junglewise.ai/threats/duplicate-advisory-invited-users-auto-promoted-via-sso-email-match-d290aa10)
- [Flowise credential lookup authorization bypass](https://junglewise.ai/threats/cve-2026-100609-flowise-npm-packages-flowise-and-flowise-components-through-3-1)
- [Flowise authentication bypass via email-only SSO matching](https://junglewise.ai/threats/cve-2026-100607-flowise-through-3-1-4-resolves-sso-and-local-password-users)
- [Flowise authentication bypass in SSO login path](https://junglewise.ai/threats/cve-2026-100606-flowise-through-3-1-4-enterprise-platform-mode-with-sso-enabled)