Executive brief
Flowise is an open-source tool used to build customized LLM orchestration flows. A vulnerability in its CSV processing component allows users to execute arbitrary code on the server. An attacker with low-level access could use this to take full control of the system, access sensitive data, or disrupt operations.
Technical details
The CSVAgent node in Flowise utilizes pyodide to execute Python code for CSV processing. While the application implements a regex-based denylist to block dangerous Python constructs (like 'eval', 'exec', or 'os'), it fails to restrict the 'pandas.read_pickle()' function. This function performs deserialization of pickled data, which can be leveraged to bypass the sandbox and achieve arbitrary code execution. An attacker with permissions to create or modify Chatflows can provide a malicious payload that uses a custom file-like object to trigger the deserialization of a base64-encoded pickle object. This vulnerability is patched in version 3.1.3.
Affected products
- FlowiseAI flowise-components <= 3.1.2
- FlowiseAI flowise <= 3.1.2
Timeline
- 2026-07-29: disclosed
- 2026-08-04: advisory
- 2026-08-04: patched