Loading vulnerability…
Command Injection in Flowise CSVAgent
CVE-2026-41137 is a command injection vulnerability in Flowise prior to version 3.1.0. The issue affects the CSVAgent component, which allows users to provide custom Pandas CSV read code. In affected versions, this custom code is not properly sanitized before being interpolated and executed by the server. As a result, an attacker can supply a malicious payload through the CSVAgent input path and trigger unintended server-side command execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in arbitrary command execution on the Flowise server in the context of the vulnerable application. This can lead to compromise of confidentiality, integrity, and availability, including access to sensitive data processed by Flowise, modification of application data or workflows, and disruption of service. The provided CVSS v4.0 vector indicates high impact across confidentiality, integrity, and availability, as well as subsequent system impacts.
If you can’t patch tonight, do this now.
As a temporary mitigation, restrict access to Flowise and specifically to workflows or features exposing CSVAgent custom Pandas CSV read code input to only trusted users. Disable or avoid use of the custom code capability where possible. Apply network access controls, strong authentication, and least-privilege role assignments to reduce the chance that a low-privileged attacker can reach the vulnerable functionality.
Patch, then assume compromise.
Upgrade Flowise to version 3.1.0 or later, which fixes the vulnerability. If upgrading is not immediately possible, remove or disable the vulnerable CSVAgent functionality that accepts custom Pandas CSV read code until the fixed version can be deployed.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.