Loading vulnerability…
Flowise CSVAgent Pyodide Code Injection RCE
CVE-2026-69264 is a critical code-injection vulnerability in Flowise and flowise-components versions earlier than 3.1.3 affecting CSVAgent. An attacker-controlled portion of a CSV data URI is directly interpolated into a Python source template executed by Pyodide. The bootstrap template is not covered by the relevant Python and custom CSV-function validation paths. On Node.js deployments, Pyodide's default JavaScript bridge exposes access to JavaScript evaluation and dynamic module loading, allowing an attacker to escape the intended Python string context and invoke Node.js capabilities from the Flowise process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary file-system operations and operating-system command execution with the privileges of the Flowise process. An attacker may compromise application data, credentials accessible to the process, the underlying host or container environment, and network resources reachable from the compromised deployment.
If you can’t patch tonight, do this now.
Until updates are deployed, restrict creation and modification of chatflows and agentflows to trusted users; require authentication for prediction interfaces that use CSVAgent; remove unnecessary CSV input override capability; and strictly validate CSV data encoding. As defense in depth, restrict Pyodide access to JavaScript host capabilities and isolate the Flowise process with least-privilege filesystem, process-execution, credential, and network controls.
Patch, then assume compromise.
Upgrade Flowise and flowise-components to version 3.1.3 or later. The corrective approach is to avoid interpolating attacker-controlled CSV content into Python source, pass data through Pyodide globals or an equivalent non-code data channel, apply validation to bootstrap code, and restrict or disable the Pyodide JavaScript bridge where it is not required.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.