Flowise Patches Critical CSVAgent RCE Flaw

Maintainers of Flowise have patched a critical remote code execution vulnerability tracked as CVE-2026-69256 and GHSA-x6vm-w76m-8j7g in the CSVAgent node component. The security defect stems from incomplete input sanitization when handling custom Python execution functions, allowing unauthorized attackers to execute arbitrary code within host environments running the application. Administrators overseeing affected Flowise installations should apply available software updates immediately to protect systems against potential exploitation.

What's at Risk

The flaw impacts the npm/flowise and npm/flowise-components software packages across all installations prior to version 3.1.3. Flowise is widely deployed to build, manage, and orchestrate automated AI workflows, language model chain applications, and interactive agent pipelines. Organizations that expose Flowise instances to untrusted networks or grant non-administrative users access to agent builder interfaces face elevated exposure to this vulnerability.

Because automation workflows frequently require access to sensitive external databases, API key stores, cloud credentials, and internal enterprise microservices, compromised application nodes present a severe security risk. A successful exploit allows attackers to execute commands within the host application context, potentially enabling access to surrounding internal network resources, proprietary workflow data, and connected system credentials.

How the Flaw Works

The affected component is located within the CSVAgent node at flowise-components/nodes/agents/CSVAgent/CSVAgent.ts. Flowise integrates pyodide to run Python scripts asynchronously so users can leverage the popular pandas library for parsing CSV data. To restrict users from executing malicious commands, the application implements a regex-based denylist mechanism defined in FORBIDDEN_PATTERNS, designed to block explicit Python import statements and dangerous built-in execution functions like eval, exec, compile, open, and breakpoint.

Despite these regex filters, the node accepts a user-controlled parameter named customReadCSVFunc when dynamic dataframe columns are loaded. Instead of supplying standard CSV parsing functions, an attacker can specify pandas methods such as read_pickle(). Python pickle files inherently allow arbitrary object instantiations during deserialization. By passing a base64-encoded pickled payload, an attacker causes the application to deserialize dangerous Python objects that execute system commands, effectively bypassing the entire import and function denylist without triggering any regex rules.

This flaw illustrates the inherent weaknesses of relying solely on regex-based denylists to sandbox code execution. Unsafe deserialization vulnerabilities occur when untrusted data streams are processed into live runtime objects. In dynamic language runtimes, deserialization routines can be manipulated to trigger arbitrary execution paths, bypassing outer parameter filters that only look for explicit keyword invocations.

How to Protect Your Systems

• Upgrade immediately to version 3.1.3 or higher for both npm/flowise and npm/flowise-components packages to apply official maintainer fixes.
• Restrict web interface exposure by placing Flowise instances behind corporate VPNs, web application firewalls, or strict IP access control lists.
• Enforce strict service isolation by running Flowise agent execution environments inside unprivileged containers with limited network access.
• Audit incoming agent parameters and log file interactions to detect unexpected pandas function invocations or abnormal base64 data payloads.
• Apply least privilege access controls across all system credentials and API tokens stored within Flowise workflow configurations.

Addressing critical remote code execution flaws in agentic platforms is vital to maintaining overall application security. Because workflow engines hold elevated privileges to connected enterprise services, promptly updating vulnerable packages ensures underlying application servers remain isolated from unauthorized execution threats.