CVE-2026-69256
CriticalCVSS 9.4Summary
Flowise prior to 3.1.3 contains a vulnerability in the CSVAgent node that allows an authenticated user to execute arbitrary code by deserializing a malicious pickle payload, bypassing the denylist of dangerous Python constructs.
Risk Assessment
The risk includes code execution on the Flowise server, potentially leading to full system and data compromise.
Recommendation
It is recommended to upgrade Flowise to version 3.1.3 or later and restrict permissions for users who can create or modify chatflows.
Original NVD description (English source)
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/<UUID> to execute commands. This issue is fixed in version 3.1.3.