# CVE-2026-69255: Flowise CSV Agent remote code execution via Pyodide code injection

Source: https://junglewise.ai/threats/cve-2026-69255-flowise-csv-agent-remote-code-execution-via-pyodide-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-08-04  
License: CC BY 4.0 with a link back

CVE-2026-69255 · Severity: critical · CVSS 8.8 · Published 2026-08-04

Flowise, an open-source tool for building LLM applications, is vulnerable to a critical security flaw in its CSV Agent component. An attacker can use this vulnerability to take complete control of the server, potentially stealing sensitive credentials, reading private files, or causing a total service outage. This has been verified to allow full administrative (root) access to the underlying system.

Technologies: [flowise (npm)](https://junglewise.ai/threats/technologies/flowise), [flowise-components (npm)](https://junglewise.ai/threats/technologies/flowise-components). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-69255 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69255 being exploited in the wild.

**How severe is CVE-2026-69255?** Critical severity, with a CVSS score of 8.8, published 4 August 2026.

**Which products and versions are affected?** flowise (npm) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.3; flowise-components (npm) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.3.

**Is there a fix for CVE-2026-69255?** Yes. flowise (npm): upgrade to 3.1.3 or later; flowise-components (npm): upgrade to 3.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69255 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-69255?** Check whether you run flowise (npm) or flowise-components (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- flowise (npm): upgrade to 3.1.3 or later

  ```sh
  npm install flowise@3.1.3
  ```

- flowise-components (npm): upgrade to 3.1.3 or later

  ```sh
  npm install flowise-components@3.1.3
  ```


## Technical details

A code injection vulnerability exists in `packages/components/nodes/agents/CSVAgent/CSVAgent.ts` within Flowise. The application performs direct string interpolation of unsanitized data from a CSV file's data URI into a Python script executed via Pyodide. By crafting a malicious CSV file, an attacker can break out of the Python string literal and use the Pyodide-to-JS bridge to access the host Node.js process. Specifically, an attacker can load the `child_process` module to execute arbitrary OS commands with root privileges. The vulnerability is present because the `validatePythonCodeForDataFrame()` denylist is not applied to the initial code block where the file content is processed. A patch is available in version 3.1.3.

## Affected products

- FlowiseAI flowise <= 3.1.2
- FlowiseAI flowise-components <= 3.1.2

## Identifiers

- CVE-2026-69255
- GHSA-vmv7-4m6c-3cg5

## Timeline

- 2026-05-20: other: Full RCE as root verified by researchers
- 2026-07-29: patched: Fix released in version 3.1.3
- 2026-08-04: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/lexi-core-ai](https://api.github.com/users/lexi-core-ai)
- [https://github.com/lexi-core-ai](https://github.com/lexi-core-ai)
- [https://api.github.com/users/lexi-core-ai/gists%7B/gist_id%7D](https://api.github.com/users/lexi-core-ai/gists%7B/gist_id%7D)
- [https://api.github.com/users/lexi-core-ai/repos](https://api.github.com/users/lexi-core-ai/repos)
- [https://avatars.githubusercontent.com/u/244018018?v=4](https://avatars.githubusercontent.com/u/244018018?v=4)
- [https://api.github.com/users/lexi-core-ai/events%7B/privacy%7D](https://api.github.com/users/lexi-core-ai/events%7B/privacy%7D)

## Related threats

- [Duplicate Advisory: INVITED users auto-promoted via SSO email match (invite-token bypass)](https://junglewise.ai/threats/duplicate-advisory-invited-users-auto-promoted-via-sso-email-match-d290aa10)
- [Duplicate Advisory: Flowise contains an unauthenticated sandbox escape](https://junglewise.ai/threats/duplicate-advisory-flowise-contains-an-unauthenticated-sandbox-escape-8959e167)
- [Flowise incomplete credential redaction in API](https://junglewise.ai/threats/cve-2026-73604-flowise-incomplete-credential-redaction-in-api)
- [Flowise text-to-speech endpoint credential abuse via unauthenticated access](https://junglewise.ai/threats/cve-2026-73603-flowise-text-to-speech-endpoint-credential-abuse-via)
- [Flowise IDOR in payment source endpoint](https://junglewise.ai/threats/cve-2026-73488-flowise-idor-in-payment-source-endpoint)