CVE-2026-41264
published 2026-04-23CVE-2026-41264: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the run method of the…
PriorityP273critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
1.44%
71.0th percentile
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the run method of the CSV_Agents class. The issue results from the lack of proper sandboxing when evaluating an LLM generated python script. An attacker can leverage this vulnerability to execute code in the context of the user running the server. Using prompt injection techniques, an unauthenticated attacker with the ability to send prompts to a chatflow using the CSV Agent node may convince an LLM to respond with a malicious python script that executes attacker controlled commands on the Flowise server. This vulnerability is fixed in 3.1.0.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| flowiseai | flowise | < 3.1.0 | 3.1.0 |
| flowiseai | flowise | >= 0 < 3.1.0 | 3.1.0 |
| flowiseai | flowise | >= 0 < 3.1.3 | 3.1.3 |
| flowiseai | flowise-components | >= 0 < 3.1.3 | 3.1.3 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthenticated HTTP requests to Flowise chatflow endpoints that include CSV file uploads combined with prompt injection payloads targeting the CSV Agent node; successful exploitation results in arbitrary Python code execution as the server process user. ↗
- →Alert on Flowise process spawning unexpected child processes (e.g., shells or system commands) originating from the CSV_Agents run method, which indicates successful prompt-injection-driven code execution. ↗
- →Flag API requests that supply an API key with chatflows:create permission to Flowise endpoints followed by chatflow interaction — the Metasploit module requires this permission level to stage the exploit but does not require Flowise authentication for the RCE trigger itself. ↗
- →Scope detection to Flowise versions 1.3.0 through 3.0.13; instances running 3.1.0 or later are patched and should not be targeted. ↗
- ·The Metasploit module stages exploitation by first creating a chatflow (requiring chatflows:create API permission), meaning environments that restrict API key permissions or disable the chatflows API may limit exploitability even on vulnerable versions. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
ghsa·2026-08-04
CVE-2026-69255 [CRITICAL] CWE-94 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
## UPDATE 2026-05-20: Full RCE as root VERIFIED
**This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2.**
### Verified Exploit Chain
1. Python code injection via `base64_string = "${base64String}"` (CSVAgent.ts line 161)
2. Pyodide `js` bridge provides access to the host Node.js process
3. `process.mainModule.constructor._load('child_process')` loads child_process (bypasses ESM require restriction)
4. `.execSync('CMD')` executes arbitrary OS commands as **root** (PID 1 in container)
### Working RCE Payload
```
";import js;e=js.globalThis.eval;e("process.mainModule.constructor._load('child_process').execSync('id')");#
```
**Constraint:** No
VulDB
FlowiseAI Flowise up to 3.0.x CSV_Agents incomplete blacklist (GHSA-3hjv-c53m-58jj)
vuldb·2026-04-23·CVSS 9.2
CVE-2026-41264 [CRITICAL] FlowiseAI Flowise up to 3.0.x CSV_Agents incomplete blacklist (GHSA-3hjv-c53m-58jj)
A vulnerability, which was classified as critical, has been found in FlowiseAI Flowise up to 3.0.x. This affects the function CSV_Agents. The manipulation leads to incomplete blacklist.
This vulnerability is listed as CVE-2026-41264. The attack may be initiated remotely. There is no available exploit.
It is advisable to upgrade the affected component.
GHSA
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
ghsa·2026-04-21
CVE-2026-41264 [CRITICAL] CWE-184 Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
## Abstract
Trend Micro's Zero Day Initiative has identified a vulnerability affecting FlowiseAI Flowise.
## Vulnerability Details
- **Version tested:** 3.0.13
- **Installer file:** https://github.com/FlowiseAI/Flowise
- **Platform tested:** Ubuntu 25.10
## Analysis
This vulnerability allows remote attackers to execute arbitrary code on affected installations of FlowiseAI Flowise. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the `run` method of the `CSV_Agents` class. The issue results from the lack of proper sandboxing when evaluating an LLM-generated Python script. An attacker can leverage this vulnerability to execute code in the context of the user running the
No detection rules found.
2026-04-23
Published