Loading vulnerability…
Python Code Injection RCE in Flowise CSVAgent
CVE-2026-69255 is a code-injection vulnerability in the CSVAgent component of Flowise and flowise-components versions earlier than 3.1.3. CSVAgent extracts attacker-controlled CSV input using file.split(',').pop() and directly interpolates the resulting value into a quoted Python assignment before execution through Pyodide. An attacker can terminate the string literal and inject arbitrary Python code. The validatePythonCodeForDataFrame() denylist checks only subsequent LLM-generated code, leaving this initial code block unvalidated. Injected Python can use Pyodide's JavaScript bridge to access Node.js child_process and execute operating-system commands, including as root inside affected Flowise containers.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of the affected Flowise instance. Arbitrary command execution can enable credential theft, arbitrary file access, modification of application data, and denial of service by crashing the Node.js process. Root-level execution inside the Flowise container has been demonstrated. A compromised instance can also provide a foothold for lateral movement to reachable systems; container-root access does not by itself establish escape to the underlying host.
If you can’t patch tonight, do this now.
Until an upgrade is deployed, disable or avoid the vulnerable CSVAgent functionality and prevent untrusted users from supplying CSV or data-URI input to it. Where an interim code change is feasible, bind the input through pyodide.globals.set rather than constructing a Python string literal. Strict base64-only validation or correctly escaping double quotes, newlines, carriage returns, and backslashes are alternative interim measures. The existing validation of later LLM-generated code does not protect the initial vulnerable block.
Patch, then assume compromise.
Upgrade Flowise and affected flowise-components packages to version 3.1.3 or later. For maintained code forks, replace direct interpolation of CSV-derived data into executable Python with Pyodide variable binding through pyodide.globals.set. This separates untrusted data from executable code.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.