CVE-2026-69264

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description The CSVAgent component interpolates a segment of the csvFile data URI directly into a Python source-code template executed by Pyodide. Because Pyodide is loaded with a default JavaScript bridge to globalThis, an attacker can break out of the Python string literal and use js.eval to dynamically import Node.js built-in modules such as fs and child process. This allows for arbitrary file I/O or OS command execution with the privileges of the Flowise process. The issue is triggered when a user with chatflows:create or update permissions plants a crafted csvFile in a CSV Agent node; subsequently, any unauthenticated request to the POST /api/v1/prediction/:id endpoint triggers the execution. The existing validator functions validatePythonCodeForDataFrame() and validateCustomReadCSVFunction() are not applied to the bootstrap template, leaving it unprotected.

Recommendations Update to version 3.1.3. As a temporary mitigation, set chatflow.apikeyid on every chatflow using CSVAgent to enforce authentication on the POST /api/v1/prediction/:id endpoint. Restrict chatflows:create and agentflows:create permissions to trusted users only. Restrict the chatbotConfig.allowedOrigins to a strict list of trusted origins.