This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the run method of the CSV Agents class. The issue results from insufficient input sanitization when using untrusted data to construct an LLM prompt. An attacker can leverage this vulnerability to execute code in the context of the service account.

let pythonCode = ''
if (dataframeColDict) {
  const chain = new LLMChain({
    llm: model,
    prompt: PromptTemplate.fromTemplate(systemPrompt),
    verbose: process.env.DEBUG === 'true' ? true : false
  })
  const inputs = {
    dict: dataframeColDict,
    question: input // user-controlled input substituted into prompt
  }
  const res = await chain.call(inputs, [loggerHandler, ...callbacks])
  pythonCode = res?.text // LLM response assigned to pythonCode
  pythonCode = pythonCode.replace(/^```[a-z]+
|
```$/gm, '')
}

let finalResult = ''
if (pythonCode) {
  const validation = validatePythonCodeForDataFrame(pythonCode) // blocklist validation applied
  if (!validation.valid) {
    throw new Error(
      `Generated code was rejected for security reasons (${
        validation.reason ?? 'unsafe construct'
      }). Please rephrase your question to use only pandas DataFrame operations.`
    )
  }
  try {
    const code = `import pandas as pd
import numpy as np
${pythonCode}`
    finalResult = await pyodide.runPythonAsync(code) // executed in unsandboxed pyodide
  } catch (error) {
    throw new Error(`Sorry, I'm unable to find answer for question: "${input}" using following code: "${pythonCode}"`)
  }
}

python3 poc.py --mode [server OR chatflow OR prompt injection] [--user <USER> --passwd <PASSWORD> --host <HOST> --r host <R HOST> --r port <R PORT> --l port <L PORT> --port <PORT> --cmd <CMD> --attack <ATTACK> --chatflow id <CHAT ID>]