CVE-2026-69264 in Flowise
Summary
by MITRE • 08/04/2026
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import, the attacker can break out of the Python string literal, hand a JavaScript string to js.eval, dynamically import Node built-in modules such as fs and child_process, and execute arbitrary file I/O or OS commands as the Flowise process. The two validator paths around this code, validatePythonCodeForDataFrame and validateCustomReadCSVFunction, are never applied to the bootstrap template. A workspace user with chatflows:create or agentflows/chatflows update permission can plant a CSV Agent node with a crafted csvFile; once the chatflow is exposed via POST /api/v1/prediction/:id, any unauthenticated request triggers host remote code execution. This issue is fixed in version 3.1.3.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/04/2026
This vulnerability exists in Flowise versions prior to 3.1.3 where the CSVAgent component fails to properly sanitize user-controlled data when processing CSV files through data URI schemes. The flaw stems from a dangerous interpolation pattern where attacker-controlled content from csvFile parameters is directly embedded into Python source code templates without adequate validation or escaping mechanisms. This represents a classic server-side template injection vulnerability that has been exacerbated by the use of Pyodide's JavaScript bridge capabilities within Node.js environments, creating an attack vector that transcends traditional language boundaries.
The technical implementation of this vulnerability leverages Pyodide's default js bridge configuration which exposes globalThis in Node.js environments, providing direct access to powerful JavaScript functions including eval and dynamic import. When an attacker crafts a malicious CSV file containing specially formatted data within the csvFile parameter, they can manipulate the Python string literal context through injection techniques that break out of expected code boundaries. This allows them to pass arbitrary JavaScript strings to js.eval and subsequently utilize dynamic import statements to load Node.js built-in modules such as fs for file system operations and child_process for executing OS commands.
The impact of this vulnerability extends beyond simple code execution, as it provides complete arbitrary file I/O and operating system command execution capabilities with the privileges of the Flowise process. This represents a severe privilege escalation scenario where an attacker can gain full control over the host system. The security controls that should have prevented this attack, specifically the validatePythonCodeForDataFrame and validateCustomReadCSVFunction validator functions, are completely bypassed in the bootstrap template processing path, meaning no input validation occurs before the dangerous interpolation takes place.
This vulnerability aligns with CWE-94 (Improper Control of Generation of Code) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), while also demonstrating characteristics of attack patterns described in MITRE ATT&CK framework under T1059.006 (Python) and T1059.007 (JavaScript). The attack requires minimal privileges - only workspace users with chatflows:create or agentflows/chatflows update permissions can exploit this, making it particularly dangerous as it allows for privilege escalation from low-privilege user accounts to full system compromise. Once a malicious CSV Agent node is planted within a chatflow and that flow is exposed via the POST /api/v1/prediction/:id endpoint, any unauthenticated user can trigger the remote code execution, creating an automatic exploit vector that does not require authentication.
The fix implemented in version 3.1.3 addresses this vulnerability by properly sanitizing user input before interpolation into Python templates and ensuring that the validation functions are consistently applied throughout all code paths. This includes implementing proper input validation, escaping mechanisms for template interpolation, and removing or restricting the dangerous JavaScript bridge capabilities that were enabling the exploitation. Organizations should immediately upgrade to version 3.1.3 or higher to protect against this critical remote code execution vulnerability that could allow complete system compromise through a single malicious CSV file upload.