{"id":"EUVD-2026-52745","enisaUuid":"263da253-5a6e-347f-b985-21db5a07423e","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split(\u0027,\u0027).pop() and interpolated it directly into executable Python as base64_string \u003d \"${base64String}\" before calling Pyodide. The validatePythonCodeForDataFrame() denylist only checked later LLM-generated code and did not validate this initial code block. An authenticated attacker could inject a closing quote followed by Python code, use Pyodide\u0027s js bridge to load Node.js child_process, and execute arbitrary operating system commands as root in the Flowise container. This issue is fixed in version 3.1.3.","datePublished":"Aug 4, 2026, 3:39:39 PM","dateUpdated":"Aug 4, 2026, 7:52:22 PM","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-vmv7-4m6c-3cg5\nhttps://github.com/FlowiseAI/Flowise/pull/6499\nhttps://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c\nhttps://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.3\n","aliases":"CVE-2026-69255\nGHSA-vmv7-4m6c-3cg5\n","assigner":"GitHub_M","epss":0.6,"enisaIdProduct":[{"id":"f0369003-d090-37a5-a954-ef36715fa88b","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.3"}],"enisaIdVendor":[{"id":"28b96796-efa7-3655-bd6b-cd0209347160","vendor":{"name":"FlowiseAI"}}],"enisaIdVulnerability":[{"id":"a5b7a42b-e896-38a7-be43-0ec91fadba0e","vulnerability":{"id":"GHSA-vmv7-4m6c-3cg5","description":"Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified","datePublished":"Aug 4, 2026, 3:40:28 PM","dateUpdated":"Aug 4, 2026, 3:41:21 PM","baseScore":0.0,"references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-vmv7-4m6c-3cg5\nhttps://github.com/FlowiseAI/Flowise/pull/6499\nhttps://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c\nhttps://github.com/FlowiseAI/Flowise\nhttps://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.3\n","enisa_id":"EUVD-2026-52745\n","aliases":"CVE-2026-69255\nGHSA-vmv7-4m6c-3cg5\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d95264d7-c8a6-3e15-be95-9ff64940d00e","vulnerability":{"id":"CVE-2026-69255","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split(\u0027,\u0027).pop() and interpolated it directly into executable Python as base64_string \u003d \"${base64String}\" before calling Pyodide. The validatePythonCodeForDataFrame() denylist only checked later LLM-generated code and did not validate this initial code block. An authenticated attacker could inject a closing quote followed by Python code, use Pyodide\u0027s js bridge to load Node.js child_process, and execute arbitrary operating system commands as root in the Flowise container. This issue is fixed in version 3.1.3.","datePublished":"Aug 4, 2026, 3:39:39 PM","dateUpdated":"Aug 4, 2026, 7:52:22 PM","status":"PUBLISHED","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-vmv7-4m6c-3cg5\nhttps://github.com/FlowiseAI/Flowise/pull/6499\nhttps://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c\nhttps://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.3\n","enisa_id":"EUVD-2026-52745\n","assigner":"GitHub_M","epss":0.6,"dataProcessed":"Nov 5, 2026, 7:16:35 AM","vulnerabilityProduct":[{"id":"8d49121f-e3b1-3b3e-9242-47c76df26f7f","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.3"}],"vulnerabilityVendor":[{"id":"3d2d60ae-767f-3c1e-81d7-cd39d9b7a63f","vendor":{"name":"FlowiseAI"}}]}}],"enisaIdAdvisory":[]}