# CVE-2026-73486: Flowise CSV Agent code injection via customReadCSV

Source: https://junglewise.ai/threats/cve-2026-73486-flowise-csv-agent-code-injection-via-customreadcsv  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73486 · Severity: high · CVSS 8.8 · Published 2026-08-13

Flowise is a low-code platform for building AI chatbots and workflows. An authenticated attacker can inject and execute arbitrary Python code through the CSV Agent node's customReadCSV parameter, bypassing security validation through obfuscation techniques. This allows complete system compromise and arbitrary code execution on the server running Flowise.

## Quick answers

**Is CVE-2026-73486 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73486 being exploited in the wild.

**How severe is CVE-2026-73486?** High severity, with a CVSS score of 8.8, published 13 August 2026.

**Which products and versions are affected?** Flowise Flowise before 3.1.3.

**Is there a fix for CVE-2026-73486?** A patch was published on 2026-08-13: Version 3.1.3 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73486 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73486?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a code injection flaw (CWE-94) in the CSV Agent node's run method, where user-supplied customReadCSV parameters are directly interpolated into Python code executed in an unsandboxed pyodide environment. The vulnerable code attempts validation via a static regex blocklist in validatePythonCodeForDataFrame(), but this can be bypassed through eight documented obfuscation techniques including decorator syntax, chr() encoding, MRO traversal, frame inspection, and variable aliasing. An authenticated user can craft a malicious chatflow that executes arbitrary Python code with full system access. Flowise versions before 3.1.3 are affected; patched versions 3.1.3 and later are available.

## Affected products

- Flowise Flowise before 3.1.3

## Timeline

- 2026-07-29: disclosed: GitHub Security Advisory GHSA-4878-cqgq-j53v published
- 2026-08-13: advisory: CVE-2026-73486 assigned and published
- 2026-08-13: patched: Version 3.1.3 released with fix

## References

- [https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4878-cqgq-j53v](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4878-cqgq-j53v)
- [https://www.vulncheck.com/advisories/flowise-before-code-injection-via-csv-agent-customreadcsv](https://www.vulncheck.com/advisories/flowise-before-code-injection-via-csv-agent-customreadcsv)