Executive brief
Flowise, an open-source tool for building LLM applications, is vulnerable to a critical security flaw in its CSV Agent component. An attacker can use this vulnerability to take complete control of the server, potentially stealing sensitive credentials, reading private files, or causing a total service outage. This has been verified to allow full administrative (root) access to the underlying system.
Technical details
A code injection vulnerability exists in `packages/components/nodes/agents/CSVAgent/CSVAgent.ts` within Flowise. The application performs direct string interpolation of unsanitized data from a CSV file's data URI into a Python script executed via Pyodide. By crafting a malicious CSV file, an attacker can break out of the Python string literal and use the Pyodide-to-JS bridge to access the host Node.js process. Specifically, an attacker can load the `child_process` module to execute arbitrary OS commands with root privileges. The vulnerability is present because the `validatePythonCodeForDataFrame()` denylist is not applied to the initial code block where the file content is processed. A patch is available in version 3.1.3.
Affected products
- FlowiseAI flowise <= 3.1.2
- FlowiseAI flowise-components <= 3.1.2
Timeline
- 2026-05-20: other: Full RCE as root verified by researchers
- 2026-07-29: patched: Fix released in version 3.1.3
- 2026-08-04: advisory: GitHub Advisory published