Loading vulnerability…
Flowise CSV Agent Prompt-Injection Remote Code Execution
CVE-2026-41264 is a remote code execution vulnerability in Flowise versions prior to 3.1.0. The CSV_Agents class run method evaluates Python scripts generated by an LLM without adequate sandboxing. An attacker can use prompt injection against a chatflow containing the CSV Agent node to cause the LLM to generate a malicious Python script, which Flowise then evaluates in the security context of the account running the Flowise server.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits execution of attacker-controlled commands on the Flowise server with the privileges of the Flowise server process. This can compromise the confidentiality, integrity, and availability of the affected Flowise deployment and resources accessible to that process.
If you can’t patch tonight, do this now.
Until upgrades are complete, disable or remove CSV Agent nodes from externally reachable chatflows. Restrict access to chatflows that use the CSV Agent node to trusted, authenticated users, and apply controls to prevent untrusted prompt content from reaching LLM-driven code-generation workflows.
Patch, then assume compromise.
Upgrade Flowise to version 3.1.0 or later, which contains the fix for CVE-2026-41264.
No validated public exploits yet. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.