CVE-2026-69256

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description An authenticated user with permissions to create or modify a chatflow can achieve remote code execution via the CSVAgent node. The node allows users to provide Python code executed through pyodide, which is a Python distribution for the browser. Although a denylist is used to block dangerous Python constructs, the pandas.read pickle() function can be used to deserialize a pickled payload, bypassing the filter and executing arbitrary commands. The issue exists in the file flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where the user-supplied customReadCSVFunc variable is evaluated. An attacker can trigger the execution by sending a request to the /api/v1/prediction/<UUID> endpoint.

Recommendations Update Flowise to version 3.1.3. As a temporary workaround, restrict access to the CSVAgent node or avoid using the customReadCSVFunc parameter until the update is applied.