CVE-2026-69264
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk65th percentile - higher than 65% of all known CVEs
Summary
Flowise prior to 3.1.3 contains a vulnerability in CSVAgent that allows an attacker to inject code into a Python template executed by Pyodide, enabling arbitrary OS command execution on the Flowise host. An unauthenticated request to the API can trigger remote code execution.
Risk Assessment
The risk includes remote code execution on the Flowise server, potentially leading to full system and data compromise.
Recommendation
It is recommended to immediately upgrade Flowise to version 3.1.3 or later and restrict access to the prediction API.
Other vulnerabilities in Flowise
See all- CVE-2026-91930High
Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. An attacker can add themselves as organization owners, create workspaces, and gain administrative access to victim organizations.
- CVE-2026-91929High
Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. An attacker with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse stored SSO secrets.
- CVE-2026-52098Critical
An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint.
- CVE-2026-73602Critical
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass.
- CVE-2026-73487Critical
Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection.
- CVE-2026-67622Critical
A vulnerability in Flowise (up to 3.1.4) in the OpenAI Assistants integration allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID without workspace ownership verification.
- CVE-2026-70478Critical
Flowise prior to 3.1.3 contains a vulnerability in the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint, which is in WHITELIST_URLS and requires no authentication. An attacker with a credential ID can refresh the OAuth token and gain access to the victim's connected service, as well as exhaust refresh-token quota.
- CVE-2026-70477Critical
Flowise before version 3.1.3 contains a prompt injection vulnerability in the CSV Agent node, allowing a malicious Python script to bypass the blocklist validator and execute in an unsandboxed Pyodide environment. An attacker can leverage this to execute arbitrary code in the context of the service account.
- CVE-2026-70470Critical
Flowise prior to 3.1.3 contains a vulnerability in the Python code validator that can be bypassed with Unicode homoglyphs, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host.
- CVE-2026-69263Critical
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install and execute the named package when a Custom MCP server launched. This issue is fixed in version 3.1.3.
Original NVD description (English source)
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import, the attacker can break out of the Python string literal, hand a JavaScript string to js.eval, dynamically import Node built-in modules such as fs and child_process, and execute arbitrary file I/O or OS commands as the Flowise process. The two validator paths around this code, validatePythonCodeForDataFrame and validateCustomReadCSVFunction, are never applied to the bootstrap template. A workspace user with chatflows:create or agentflows/chatflows update permission can plant a CSV Agent node with a crafted csvFile; once the chatflow is exposed via POST /api/v1/prediction/:id, any unauthenticated request triggers host remote code execution. This issue is fixed in version 3.1.3.