Loading story…
Flowise disclosed and fixed CVE-2026-69255, a high-severity remote code execution flaw in the CSVAgent component affecting versions earlier than 3.1.3. The bug stemmed from attacker-controlled CSV content being inserted directly into executable Python before being passed to Pyodide, allowing code injection. Because Flowise validated only later LLM-generated code and not the initial Python block, an attacker could escape the intended string context, pivot through Pyodide's JavaScript bridge, reach Node.js child_process, and execute arbitrary operating system commands as root inside the Flowise container.
A related Flowise GitHub commit shows the vendor removed both CSVAgent and AirtableAgent and deleted Python code validation functionality as part of the security response. The change also removed the pyodide dependency and deleted more than 1,600 lines of code, indicating a broad rollback of the affected feature set rather than a narrow patch. The vulnerability is tracked as CWE-94 and is addressed in Flowise 3.1.3.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
A new CVE entry, CVE-2026-70477, was received for a Flowise CSV Agent prompt-injection flaw that can lead to arbitrary code execution via malicious Python generated and executed in an unsandboxed Pyodide environment. The advisory says the issue is fixed in Flowise 3.1.3 and references Flowise PR #6499, the fix commit, and GitHub Security Advisory GHSA-5xvg-pmgg-3mxr.
The CVE entry states that CVE-2026-69255, a Flowise CSVAgent code-injection flaw leading to remote code execution, was newly received by security-advisories@github.com. The issue affects Flowise versions earlier than 3.1.3 and is tracked in GitHub Security Advisory GHSA-vmv7-4m6c-3cg5.
A verified Flowise Git commit removed the CSVAgent and AirtableAgent components, deleted Python code validation files, and removed the pyodide dependency, with the commit message stating the components were removed due to security vulnerabilities. This commit is referenced as the fix associated with Flowise issue 606 and pull request #6499.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Flowise disclosed and fixed a cluster of high-severity vulnerabilities in versions prior to **3.1.0**, including multiple paths to remote code execution. The most serious issues affect the platform's CSV and Airtable agent components, where unsanitized user input or LLM-generated Python code could be evaluated without proper sandboxing. Advisories for **`CVE-2026-41137`**, **`CVE-2026-41264`**, **`CVE-2026-41138`**, and **`CVE-2026-41265`** describe authenticated and unauthenticated attack paths that let attackers inject malicious payloads through chatflows or agent inputs and execute code on the Flowise server, with potential impact to confidentiality, integrity, and availability. Flowise **3.1.0** also addresses non-RCE flaws that could expose multi-tenant environments and consume third-party service credits. **`CVE-2026-41279`** affects the unauthenticated text-to-speech endpoint at **`POST /api/v1/text-to-speech/generate`**, which could accept an arbitrary **`credentialId`** and use decrypted stored credentials such as OpenAI or ElevenLabs API keys to generate speech, enabling API credit abuse. In **Flowise Cloud**, **`CVE-2026-41267`** allows improper mass assignment during account registration, letting unauthenticated attackers inject server-managed fields and manipulate organization associations, ownership metadata, timestamps, and role mappings across tenants. Organizations running Flowise or Flowise Cloud should upgrade to **3.1.0** and review exposed chatflows, stored credentials, and tenant registration controls.
Jun 29, 2026
Researchers at **elttam** disclosed **six remote code execution vulnerabilities** in the **Flowise** AI agent and workflow platform, affecting versions **3.1.1** and **3.1.2**. The flaws could allow attackers to execute code on exposed Flowise servers, raising concerns for organizations using the platform to orchestrate AI workflows and integrations. Reporting on the issue also referenced Flowise-related local and container paths and endpoints tied to authentication, document processing, and custom function handling, including sensitive files such as `/proc/self/environ` and `/root/.flowise/database.sqlite`. Those details suggest attackers could pursue local file access and post-exploitation activity after initial compromise, adding to concerns around Flowise's recurring history of critical security advisories.
Sep 3, 2026
A critical remote code execution vulnerability, tracked as CVE-2025-61913, has been identified in Flowise, a drag-and-drop user interface for building customized large language model flows. The flaw exists in versions prior to 3.0.8 and is caused by insufficient restrictions in the WriteFileTool and ReadFileTool components, which fail to properly validate file path access. This oversight allows authenticated attackers to read and write arbitrary files to any location on the file system, significantly increasing the risk of remote code execution. The vulnerability has been assigned a CVSS score of 10.0, indicating its maximum severity and potential for exploitation. According to security advisories, the issue can be exploited remotely, making it a high-priority concern for organizations using affected versions of Flowise. The vulnerability was publicly disclosed on October 8, 2025, and a security update was released in version 3.0.8 to address the issue. Attackers leveraging this flaw could gain unauthorized access to sensitive files, modify system configurations, or deploy malicious payloads, potentially leading to full system compromise. The vulnerability affects all installations of Flowise prior to the patched version, though the exact list of affected products and vendors has not been fully enumerated. Security researchers emphasize the critical nature of the flaw due to the ease of exploitation and the broad impact on confidentiality, integrity, and availability. Organizations are strongly advised to upgrade to Flowise version 3.0.8 or later to mitigate the risk. The vulnerability was reported through GitHub security advisories, highlighting the importance of monitoring open-source project disclosures. No evidence of active exploitation in the wild has been reported as of the disclosure date, but the public availability of technical details increases the urgency for remediation. The flaw underscores the risks associated with insufficient input validation in file handling components of web applications. Security teams should review their deployment of Flowise and apply the necessary patches without delay. In addition to patching, organizations should audit access logs for signs of suspicious file operations that could indicate attempted exploitation. The incident serves as a reminder of the critical need for secure coding practices and regular vulnerability assessments in software development.
Jun 29, 2026