Loading vulnerability…
Flowise CSVAgent pandas.read_pickle Code Execution
CVE-2026-69256 is a remote code-execution vulnerability in Flowise and flowise-components before version 3.1.3. The CSVAgent component evaluates a user-controlled custom CSV-read expression through Pyodide with a denylist intended to restrict dangerous Python constructs. An attacker can invoke pandas.read_pickle() with a malicious serialized pickle payload, bypassing the denylist and causing unsafe deserialization and execution of attacker-controlled code.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary command execution in the context of the vulnerable Flowise process. This can compromise the confidentiality, integrity, and availability of the Flowise instance, including access to data and resources reachable by that process; it may also enable follow-on activity against connected systems.
If you can’t patch tonight, do this now.
Until updates can be applied, disable or avoid CSVAgent nodes and prohibit untrusted users from creating or modifying chatflows or supplying custom CSV-read functions. Restrict access to Flowise administration and chatflow-authoring capabilities to trusted users, and review existing CSVAgent configurations for use of unsafe deserialization functions.
Patch, then assume compromise.
Upgrade Flowise and flowise-components to version 3.1.3 or later. Review existing chatflow configurations for CSVAgent nodes using custom CSV-read functionality, remove untrusted or unsafe configurations, and ensure CSV processing does not use unsafe pickle deserialization.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.