CVE-2026-69256(flowiseai / flowise)

LOWCVSS 8.8 · HIGH

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/<UUID> to execute commands. This issue is fixed in version 3.1.3.

flowiseai CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Weakness type (CWE)

CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

flowise

Affected systems

Vendors

flowiseai

Products

flowise

Deep dive

Full discourse3 posts

Upwind Security MDR@UpwindMDR46d
Exploit
🚨Critical - Flowise CSVAgent Remote Code Execution via http://pandas.read_pickle (CVE-2026-69256) Flowise's CSVAgent node runs user-supplied Python in pyodide for pandas CSV processing, guarded by a denylist (imports, eval/exec, os./subprocess., dunder reflection, etc.). But the denylist misses http://pandas.read_pickle() - an allowed function that deserializes a pickle. An attacker supplies a customReadCSVFunc that calls http://pd.read_pickle() on a crafted pickle, and deserialization executes an embedded os.system() payload - arbitrary command execution on the host, triggerable by a POST to /api/v1/prediction/<UUID>. A full PoC is public. CVSS 9.4. 👉Upgrade flowise / flowise-components to 3.1.3
Post summary
The post details a critical remote code execution flaw in Flowise’s CSVAgent, describing how a crafted pickle via pd.read_pickle() can trigger os.system calls, confirms the existence of a public PoC, and advises upgrading to a patched version. No mention of active wild exploitation or false positives is present.
2001086
281 followersView on X
Hephaestvs@Vulcanux_44d
PoC
csirt_it: ‼️ #Flowise: #PoC per CVE-2026-70476, CVE-2026-70474, CVE-2026-70473, CVE-2026-70470, CVE-2026-69264, CVE-2026-69263, CVE-2026-69257, CVE-2026-69256 e CVE-2026-69255 Rischio: 🔴 Tra le tipologie 🔸 Information Disclosure 🔗 … https://t.co/N9ohNZ3AC1
Post summary
The tweet announces a Proof of Concept for several CVEs, identifying them as information disclosure vulnerabilities and providing a link to the PoC details; it does not mention active exploitation, patches, or debunking.
0000049
628 followersView on X
Upwind Security MDR@UpwindMDR46d
Exploit
🚨Critical - Flowise CSVAgent Remote Code Execution to Root (CVE-2026-69255) Flowise's CSVAgent node interpolates uploaded CSV / data-URI content directly into an executable Python string with no sanitization, and its denylist only covers later LLM-generated code - not this block. A crafted input breaks out of the string and runs attacker Python. From the pyodide sandbox, that pivots to the host Node.js process to run arbitrary OS commands. It's been verified to a root shell, with credential theft, arbitrary file read, and DoS, and a public exploit module exists. CVSS 9.2 (advisory notes 9.9). 👉Upgrade flowise and flowise-components to 3.1.3 (also fixes CVE-2026-69256), and keep Flowise off untrusted networks.
Post summary
CVE-2026-69255 is a critical RCE in Flowise's CSVAgent that lets attackers obtain root access; a public exploit module has been released and a patch is available.
00000135
281 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	flowiseai	flowise	-	-	-

Explore more

Back to dashboard flowiseai CVEs flowise vulnerabilities

What researchers are saying

CVE-2026-69256

Upwind Security MDR[verified]@UpwindMDRExploit

The post details a critical remote code execution flaw in Flowise’s CSVAgent, describing how a crafted pickle via pd.read_pickle() can trigger os.system calls, confirms the existence of a public PoC, and advises upgrading to a patched version. No mention of active wild exploitation or false positives is present.

Upwind Security MDR[verified]@UpwindMDRExploit

CVE-2026-69255 is a critical RCE in Flowise's CSVAgent that lets attackers obtain root access; a public exploit module has been released and a patch is available.

Hephaestvs@Vulcanux_PoC

The tweet announces a Proof of Concept for several CVEs, identifying them as information disclosure vulnerabilities and providing a link to the PoC details; it does not mention active exploitation, patches, or debunking.