Executive brief
Flowise is an open-source platform for building AI workflows that includes a CSV data analysis feature using Python. Authenticated attackers can bypass the Python sandbox restrictions by using native Pandas DataFrame methods (like to_csv, to_json, and query) to exfiltrate uploaded CSV files or write arbitrary files to the server filesystem. This exposes all sensitive data processed through the platform and allows attackers to persist malicious files on the server.
Technical details
This vulnerability is a sandbox escape (CWE-184) in pythonCodeValidator.ts that implements an incomplete denylist to restrict Python code execution within Pyodide. The validator blocks 44 dangerous patterns (eval, exec, os, subprocess) but fails to restrict native Pandas DataFrame methods. An authenticated attacker can prompt the CSVAgent LLM to generate code using allowed methods like df.to_csv(), df.to_json(), df.pipe(), or df.query() to bypass validation and achieve arbitrary file writes or data exfiltration. The attack requires network access and authentication but no user interaction beyond normal CSVAgent interaction. Flowise 3.1.3 and later patch this issue by implementing a whitelist approach instead of a denylist.
Affected products
- FlowiseAI Flowise before 3.1.3
Timeline
- 2026-07-29: disclosed: GitHub Security Advisory GHSA-x58f-9m57-qc4m published
- 2026-08-13: patched: Version 3.1.3 released with fix
- 2026-08-13: other: Repository archived by owner on disclosure date