CVE-2026-70477: Flowise RCE via CSV Agent Prompt Injection

CVE-2026-70477 · Severity: critical · CVSS 9.8 · Published 2026-08-04

Flowise is an open-source low-code platform for building AI agents that process structured data. The CSV Agent component allows users to query CSV files using natural language, but a prompt injection vulnerability enables attackers to inject malicious Python code that bypasses the security validator and executes on the server with full operating system access, leading to complete system compromise.

Technologies: flowise (npm), flowise-components (npm). Vendors: npm.

Quick answers

Is CVE-2026-70477 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-70477 being exploited in the wild.
How severe is CVE-2026-70477?
Critical severity, with a CVSS score of 9.8, published 4 August 2026.
Which products and versions are affected?
flowise (npm) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.3; flowise-components (npm) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.3.
Is there a fix for CVE-2026-70477?
Yes. flowise (npm): upgrade to 3.1.3 or later; flowise-components (npm): upgrade to 3.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70477 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-70477?
Check whether you run flowise (npm) or flowise-components (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • flowise (npm): upgrade to 3.1.3 or later
    npm install flowise@3.1.3
  • flowise-components (npm): upgrade to 3.1.3 or later
    npm install flowise-components@3.1.3

Technical details

The vulnerability exists in the CSV_Agents class run method in Flowise versions ≤3.1.2. User-controlled input is concatenated into an LLM prompt without sanitization; the LLM response (stored in pythonCode) is validated against a static regex blocklist before execution in pyodide. However, the blocklist can be bypassed using multiple obfuscation techniques including string concatenation, chr() encoding, MRO traversal, frame inspection, and decorator syntax. Additionally, pyodide is not sandboxed from the host OS, so any code passing validation executes with full system privileges. An unauthenticated attacker can trigger this via prompt injection on any exposed CSV Agent chatflow, or an authenticated attacker can configure a malicious LLM backend to directly inject payload code. The vulnerability was fixed in version 3.1.3 by removing the CSV Agent component entirely.

Affected products

  • FlowiseAI Flowise <=3.1.2
  • FlowiseAI flowise-components <=3.1.2

Identifiers

  • CVE-2026-70477
  • GHSA-5xvg-pmgg-3mxr

Timeline

  • 2026-07-29: disclosed
  • 2026-08-04: advisory: GitHub advisory GHSA-5xvg-pmgg-3mxr published
  • 2026-06-10: patched: Fix merged in commit f4e2794; CSV Agent component removed in version 3.1.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.