External risk intelligence

Flowise CSVAgent Python Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-69256

Flowise is a web-based application designed for building LLM flows and APIs. As it is frequently deployed as an internet-facing web service or API endpoint to provide LLM capabilities, the management interface and API paths are commonly reachable via the public internet.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in Flowise, a tool used for building large language model applications. The flaw, present in versions prior to 3.1.3, allows an authenticated user to execute arbitrary Python code by manipulating a CSV agent, potentially leading to unauthorized system access. The main concern is confirming relevance and exposure within our environment.

Code execution flaw in user-created flows.
Potentially impacts data integrity and system control.
Assess impact and confirm if Flowise is in use.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access can insert a malicious payload into a CSV Agent's additional parameters. This payload is designed to exploit a flaw in how Python code is executed, bypassing security checks. When the chatflow is saved and triggered, this allows the attacker to run commands on the server.

Authenticated user can modify chatflows.
User-supplied Python code is evaluated.
Server-side command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an authenticated user to execute arbitrary Python code on the server when a specially crafted CSV file is processed. This occurs because the CSVAgent node's `pandas.read_pickle()` function can deserialize a malicious payload that bypasses the denylist, enabling command execution.

Arbitrary code execution on the server.
Malicious payload via CSV Agent's parameters.
Server compromise and data exfiltration.

Operational Fix

Recommended remediation, mitigation, and detection steps

The team responsible for addressing this vulnerability will likely be the application owners or platform engineers who manage the Flowise deployment. The first practical step is to identify all instances of Flowise within the environment, confirm their reachability and business criticality, and then assign an owner for remediation planning.

Application owners should lead the effort.
Verify Flowise instances and their exposure.
Plan and coordinate necessary updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Flowise?

Flowise is a visual, drag-and-drop development platform used to build customized workflows for large language models. Developers use it to create and deploy AI-driven applications by connecting various components and nodes into chatflows, which are then often exposed as web services or API endpoints to provide intelligent automation capabilities.

What does CWE-94 mean in the context of CVE-2026-69256?

CWE-94 refers to Improper Control of Generation of Code. In CVE-2026-69256, this means the software incorrectly evaluates user-provided input as executable instructions. Specifically, the system attempts to process custom CSV agent parameters by passing them to a Python function, inadvertently allowing a malicious user to supply their own code that the server executes instead of just reading data.

How is this vulnerability triggered?

An authenticated user must intentionally add or modify a CSVAgent node within a chatflow to trigger the flaw. By inserting a specific, malicious payload into the agent's 'Additional Parameters' field and then invoking the chatflow's API endpoint, the system executes the hidden code. Simply using standard, non-malicious CSV configurations within the agent does not trigger this code execution vulnerability.

Why should I care about CVE-2026-69256?

If you host Flowise as an internet-facing service, your environment is at higher risk because the management interface and API are publicly reachable, as noted by Halo Surface Signal. Even if internal, any user with access to create or edit chatflows can leverage this flaw to gain unauthorized control over the server hosting the application, posing a significant risk to your data and infrastructure security.

What should I do if I run Flowise?

The primary response is to upgrade your Flowise deployment to version 3.1.3 or later, which resolves this flaw. Begin by auditing your environment to locate all active instances of the software, prioritize those that are network-accessible, and coordinate with your application owners to schedule and apply the update to ensure your systems are no longer vulnerable to this command execution issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.