CVE-2026-69264: Flowise Flowise RCE via Python injection in CSVAgent

CVE-2026-69264 · Severity: critical · CVSS 9.8 · Published 2026-08-04

Flowise's CSVAgent component processes CSV files by interpolating user-supplied data directly into Python code without validation. An attacker with permissions to create or modify chatflows can craft a malicious CSV file URI that breaks out of a Python string literal and executes arbitrary Node.js code (including file operations and OS commands) through Pyodide's JavaScript bridge. This allows remote code execution on the Flowise server with the privileges of the Flowise process.

Technologies: flowise (npm), flowise-components (npm). Vendors: npm.

Quick answers

Is CVE-2026-69264 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-69264 being exploited in the wild.
How severe is CVE-2026-69264?
Critical severity, with a CVSS score of 9.8, published 4 August 2026.
Which products and versions are affected?
flowise (npm) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.3; flowise-components (npm) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.3.
Is there a fix for CVE-2026-69264?
Yes. flowise (npm): upgrade to 3.1.3 or later; flowise-components (npm): upgrade to 3.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69264 attacked?
It is attacked over the network.
Am I affected by CVE-2026-69264?
Check whether you run flowise (npm) or flowise-components (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • flowise (npm): upgrade to 3.1.3 or later
    npm install flowise@3.1.3
  • flowise-components (npm): upgrade to 3.1.3 or later
    npm install flowise-components@3.1.3

Technical details

The vulnerability is a template injection in Flowise's CSVAgent.ts (lines 156–171), where the base64-encoded segment of a data URI is interpolated verbatim into a Python source template without sanitization. An attacker crafts a csvFile data URI with a payload in the base64 segment that breaks out of the Python double-quoted string literal, then calls js.eval() or uses dynamic import() to access Node.js built-in modules (fs, child_process, etc.) and execute arbitrary code. The vulnerable code path bypasses two existing validators (validatePythonCodeForDataFrame and validateCustomReadCSVFunction) which are only applied to later LLM-emitted Python, not the bootstrap template. Preconditions: an authenticated workspace user must create or update a CSV Agent node with the malicious csvFile, and the chatflow must be exposed via the public POST /api/v1/prediction/:id endpoint (which is whitelisted and works unauthenticated if the chatflow has no apiKeyId). The attack is confirmed end-to-end on Flowise 3.1.2 running on Node 20.20.2.

Affected products

  • FlowiseAI Flowise ≤ 3.1.2
  • FlowiseAI flowise-components ≤ 3.1.2

Identifiers

  • CVE-2026-69264
  • GHSA-4j8x-x6v7-w9rq

Timeline

  • 2026-08-04: disclosed: GHSA-4j8x-x6v7-w9rq published
  • 2026-06-10: patched: Flowise 3.1.3 released; CSVAgent and AirtableAgent removed (commit f4e2794)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.