CVE-2026-69256: Flowise Patches Critical CSVAgent RCE Flaw

What This Means

Advisory ID: GHSA-x6vm-w76m-8j7g (CVE-2026-69256)
Summary: Flowise: Remote Code Execution Vulnerability in CSVAgent
Severity: critical
Affected packages: npm/flowise-components (patched in 3.1.3), npm/flowise (patched in 3.1.3)
Details: ### Summary

The CSVAgent node was observed to allow users to write Python code which gets executed via `pyodide`. The original intent was to allow users to utilise the `pandas` library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, `pandas` has a `read_pickle()` [function](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html) that deserialises a pickled payload and this can be leveraged to achieve code execution.

### Details

The affected file is the `CSVAgent` node, found in: `flowise-components/nodes/agents/CSVAgent/CSVAgent.ts`.

```js
try {
    const code = `import pandas as pd
import base64
from io import StringIO
import json

base64_string = "${base64String}"

decoded_data = base64.b64decode(base64_string)

csv_data = StringIO(decoded_data.decode('utf-8'))

df = pd.${customReadCSVFunc} <1>
my_dict = df.dtypes.astype(str).to_dict()
print(my_dict)
json.dumps(my_dict)`
    dataframeColDict = await pyodide.runPythonAsync(code)
} catch (error) {
    throw new Error(error)
}
```

At <1>, the `customReadCSVFunc` is supplied by the user. This input goes through input validation that denies dangerous Python constructs from being passed in:

```py
const FORBIDDEN_PATTERNS: Array<{ pattern: RegExp; reason: string }> = [
    // Imports (the executor pre-imports pandas and numpy; LLM code must not add any imports)
    { pattern: /\bfrom\s+\S+\s+import\b/g, reason: 'import statement (from...import)' },
    { pattern: /\bimport\b/g, reason: 'import statement (all imports forbidden; pandas and numpy are pre-imported by the executor)' },
    // Dangerous builtins
    { pattern: /\beval\s*\(/g, reason: 'eval()' },
    { pattern: /\bexec\s*\(/g, reason: 'exec()' },
    { pattern: /\bcompile\s*\(/g, reason: 'compile()' },
    { pattern: /\b__import__\s*\(/g, reason: '__import__()' },
    { pattern: /\bopen\s*\(/g, reason: 'open()' },
    { pattern: /\bbreakpoint\s*\(/g, reason: 'breakpoint()' },

How to Fix It

• Upgrade npm/flowise and npm/flowise-components to version 3.1.3 or later.
• Restrict network access to Flowise administrative interfaces using firewalls or VPNs.
• Isolate agent execution nodes in restricted, unprivileged container environments.
• Monitor system logs for abnormal base64 data payloads or unusual pandas function calls.