Executive brief
Flowise is an open-source tool used to build customized AI workflows and chatbots. A vulnerability in its CSV processing component allows an attacker to trick the system into running malicious code on the server. This could lead to a complete takeover of the server, potentially exposing sensitive data or disrupting business operations.
Technical details
A Remote Code Execution (RCE) vulnerability exists in the CSV Agent node of Flowise due to insufficient input sanitization and a weak sandbox environment. When a user provides input to a chatflow using the CSV Agent, the input is used to construct a prompt for a Large Language Model (LLM). An attacker can use prompt injection to force the LLM to generate malicious Python code. While Flowise attempts to validate this code using a regex-based blocklist, the validator can be bypassed using various obfuscation techniques (e.g., string concatenation, MRO traversal, or decorators). The resulting code is executed in an unsandboxed Pyodide environment, allowing for arbitrary command execution in the context of the service account. The vulnerability is patched in version 3.1.3.
Affected products
- FlowiseAI flowise <= 3.1.2
- FlowiseAI flowise-components <= 3.1.2
Timeline
- 2026-07-29: disclosed: Initial disclosure and patch release
- 2026-08-04: advisory: GitHub Advisory published
References
- https://api.github.com/users/zdi-disclosures
- https://github.com/zdi-disclosures
- https://api.github.com/users/zdi-disclosures/gists%7B/gist_id%7D
- https://api.github.com/users/zdi-disclosures/repos
- https://avatars.githubusercontent.com/u/176422878?v=4
- https://api.github.com/users/zdi-disclosures/events%7B/privacy%7D