FlowiseAI Flowise up to 3.1.2 CSVAgent CSVAgent.ts pandas.read_pickle customReadCSVFunc deserialization

Summaryinfo

A vulnerability has been found in FlowiseAI Flowise up to 3.1.2 and classified as critical. This affects the function pandas.read_pickle of the file flowise-components/nodes/agents/CSVAgent/CSVAgent.ts of the component CSVAgent. The manipulation of the argument customReadCSVFunc leads to deserialization. This vulnerability is documented as CVE-2026-69256. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in FlowiseAI Flowise up to 3.1.2 and classified as critical. This issue affects the function pandas.read_pickle of the file flowise-components/nodes/agents/CSVAgent/CSVAgent.ts of the component CSVAgent. The manipulation of the argument customReadCSVFunc with an unknown input leads to a deserialization vulnerability. Using CWE to declare the problem leads to CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/<UUID> to execute commands. This issue is fixed in version 3.1.3.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-69256 since 08/03/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.1.3 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• FlowiseAI

Name

• Flowise

Version

• 3.1.0
• 3.1.1
• 3.1.2

Website

• Product: https://github.com/FlowiseAI/Flowise/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion