Executive brief
Flowise is a low-code platform for building AI chatbots and workflows. An authenticated attacker can inject and execute arbitrary Python code through the CSV Agent node's customReadCSV parameter, bypassing security validation through obfuscation techniques. This allows complete system compromise and arbitrary code execution on the server running Flowise.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the CSV Agent node's run method, where user-supplied customReadCSV parameters are directly interpolated into Python code executed in an unsandboxed pyodide environment. The vulnerable code attempts validation via a static regex blocklist in validatePythonCodeForDataFrame(), but this can be bypassed through eight documented obfuscation techniques including decorator syntax, chr() encoding, MRO traversal, frame inspection, and variable aliasing. An authenticated user can craft a malicious chatflow that executes arbitrary Python code with full system access. Flowise versions before 3.1.3 are affected; patched versions 3.1.3 and later are available.
Affected products
- Flowise Flowise before 3.1.3
Timeline
- 2026-07-29: disclosed: GitHub Security Advisory GHSA-4878-cqgq-j53v published
- 2026-08-13: advisory: CVE-2026-73486 assigned and published
- 2026-08-13: patched: Version 3.1.3 released with fix