CVE-2026-69255

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description An authenticated attacker can execute arbitrary operating system commands as root within the container. The issue occurs in the CSVAgent within packages/components/nodes/agents/CSVAgent/CSVAgent.ts, where attacker-controlled CSV data is extracted using file.split(',').pop() and interpolated directly into executable Python code as base64 string = "${base64String}" before being processed by Pyodide (a Python distribution for the browser). Because the validatePythonCodeForDataFrame() denylist only validates LLM-generated code and ignores this initial block, an attacker can inject a closing quote and malicious Python code. This allows the use of the Pyodide JS bridge to load the Node.js child process module and run system commands.

Recommendations Update to version 3.1.3.