Executive brief
Flowise is an open-source tool used to build customized AI workflows. A vulnerability in its CSV processing component allows an attacker to execute arbitrary commands on the server hosting the application. This could lead to a complete takeover of the system, including access to sensitive databases, encrypted credentials, and internal network resources.
Technical details
The CSVAgent component in Flowise extracts a base64-encoded segment from a user-provided 'csvFile' data URI and interpolates it directly into a Python source-code template. This template is executed using Pyodide. Because Pyodide is configured with default settings on Node.js, it exposes a bridge to 'globalThis', allowing the injected Python to call JavaScript's 'eval' or dynamic 'import()'. An attacker can use this to import Node.js modules like 'fs' or 'child_process' to perform arbitrary file I/O or command execution on the host system, bypassing the WASM sandbox. The vulnerability is reachable unauthenticated via the public prediction endpoint if a malicious chatflow has been planted by a user with 'chatflows:create' permissions.
Affected products
- FlowiseAI Flowise <= 3.1.2
- FlowiseAI flowise-components <= 3.1.2
Timeline
- 2026-07-29: advisory: GitHub Advisory published
- 2026-08-04: patched: Vulnerability fixed in version 3.1.3