CVE-2026-69256— Flowise: Remote Code Execution Vulnerability in CSVAgent
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-69256
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Flowise: Remote Code Execution Vulnerability in CSVAgent
Source: CVE Program / CVE List V5
Vulnerability Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/<UUID> to execute commands. This issue is fixed in version 3.1.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-69256
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 10677 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-69256
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-69256 (2)
Vendor Advisories for CVE-2026-69256 (1)
Vendor Pages for CVE-2026-69256 (1)
- 🔗 Release flowise@3.1.3 · FlowiseAI/Flowise · GitHubx_refsource_MISC
Same Patch Batch · FlowiseAI · 2026-08-04 · 22 CVEs total
| CVE-2026-70477 | 9.5 CRITICAL | Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability |
| CVE-2026-70470 | 9.5 CRITICAL | Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE |
| CVE-2026-69254 | 9.4 CRITICAL | Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override |
| CVE-2026-69259 | 9.4 CRITICAL | Flowise RCE via SQLite Record Manager Node |
| CVE-2026-69264 | 9.4 CRITICAL | Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python sour |
| CVE-2026-70478 | 9.2 CRITICAL | Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables tok |
| CVE-2026-69255 | 9.2 CRITICAL | Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified |
| CVE-2026-69253 | 9.0 CRITICAL | Flowise Sandbox Escape to RCE |
| CVE-2026-69251 | 9.0 CRITICAL | Flowise RCE via TypeORM DataSource |
| CVE-2026-69258 | 8.8 HIGH | Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overr |
| CVE-2026-69263 | 8.7 HIGH | Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable bloc |
| CVE-2026-69250 | 8.5 HIGH | Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration |
| CVE-2026-70473 | 8.3 HIGH | Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wi |
| CVE-2026-70476 | 8.3 HIGH | Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billin |
| CVE-2026-69257 | 7.6 HIGH | Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses |
| CVE-2026-70474 | 7.6 HIGH | Flowise: Cross-Workspace OAuth2 Credential Metadata Leak |
| CVE-2026-69252 | 7.2 HIGH | Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list a |
| CVE-2026-69262 | 7.1 HIGH | Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentfl |
| CVE-2026-70471 | 7.1 HIGH | Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure |
| CVE-2026-70472 | 7.1 HIGH | Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store |
Showing top 20 of 22 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Flowise
- CVE-2026-70478
Flowise: Unauthenticated OAuth2 token refresh endpoint retur - CVE-2026-70477
Flowise: CSV Agent Prompt Injection Remote Code Execution Vu - CVE-2026-70476
Flowise: Broken Access Control in Stripe Subscription Endpoi - CVE-2026-70475
Flowise: Missing Authorization on Execution Update Endpoint - CVE-2026-70474
Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
Same vendor: FlowiseAI
- CVE-2026-70478
Flowise: Unauthenticated OAuth2 token refresh endpoint retur - CVE-2026-70477
Flowise: CSV Agent Prompt Injection Remote Code Execution Vu - CVE-2026-70476
Flowise: Broken Access Control in Stripe Subscription Endpoi - CVE-2026-70475
Flowise: Missing Authorization on Execution Update Endpoint - CVE-2026-70474
Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
Same weakness: CWE-94
- CVE-2026-70553
MaxSite CMS Unauthenticated RCE via Install Endpoint - CVE-2026-70477
Flowise: CSV Agent Prompt Injection Remote Code Execution Vu - CVE-2026-69264
Flowise: RCE via CSVAgent csvFile data URI base64 segment is - CVE-2026-69259
Flowise RCE via SQLite Record Manager Node - CVE-2026-58074
某软件高权限用户远程代码执行漏洞
V. Comments for CVE-2026-69256
No comments yet