CVE-2026-69256 in Flowise
Summary
by MITRE • 08/04/2026
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/<UUID> to execute commands. This issue is fixed in version 3.1.3.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability exists within Flowise version 3.1.2 and earlier, specifically in the CSVAgent node functionality that enables users to execute Python code through pyodide execution environment. This flaw represents a critical code execution vulnerability that allows authenticated attackers with chatflow creation privileges to bypass security controls and execute arbitrary commands on the system. The vulnerability stems from insufficient input validation where user-supplied Python code is evaluated without proper sanitization, despite existing denylist mechanisms that should prevent dangerous constructs from being executed.
The technical implementation of this vulnerability occurs in the flowise-components/nodes/agents/CSVAgent/CSVAgent.ts file where the user-provided customReadCSVFunc parameter is directly incorporated into a pandas evaluation expression pd.${customReadCSVFunc}. This design pattern creates an execution path that allows attackers to inject malicious Python code that can be interpreted by the pyodide environment. The security control failure specifically involves the denylist mechanism that fails to block pandas.read_pickle() function calls, which can deserialize arbitrary objects and execute code during the deserialization process.
The operational impact of this vulnerability is severe as it enables authenticated privilege escalation attacks where users with minimal permissions can compromise the entire system. An attacker needs only the ability to create or modify chatflows to exploit this vulnerability, making it particularly dangerous in multi-user environments where different permission levels exist. The attack chain involves creating a CSV Agent node, placing a malicious read_pickle payload within Additional Parameters, saving the chatflow, and then triggering the /api/v1/prediction/<UUID> endpoint to execute commands. This attack vector aligns with CWE-94 (Improper Control of Generation of Code) and CWE-77: Improper Neutralization of Special Elements used in a Command.
The vulnerability demonstrates a classic sandbox escape scenario where the intended security controls are bypassed through indirect code execution paths. The use of pyodide as an execution environment provides a Python interpreter that should be restricted, but the implementation flaw allows for dangerous functionality to be accessed through legitimate pandas methods. This issue represents a failure in the principle of least privilege and proper input validation, allowing attackers to circumvent expected security boundaries. The fix implemented in version 3.1.3 addresses this by strengthening the input validation mechanism to properly block pickle deserialization functions regardless of how they might be encoded or disguised within user-supplied code.
Organizations using Flowise should immediately upgrade to version 3.1.3 or later to mitigate this vulnerability, as the attack requires minimal privileges and can lead to complete system compromise. The vulnerability also highlights the importance of comprehensive input validation and the dangers of relying solely on denylists for security controls, particularly when dealing with interpreted languages that support object serialization and deserialization functions.
This vulnerability classification aligns with ATT&CK technique T1059.001 (Command and Scripting Interpreter: Python) and T1203 (Exploitation for Client Execution), demonstrating how a seemingly minor implementation flaw can enable sophisticated attack vectors. The security implications extend beyond immediate code execution to potential data exfiltration, system reconnaissance, and further exploitation of the compromised environment through lateral movement techniques that could leverage the elevated privileges gained through this vulnerability.