External risk intelligence

Flowise CSV Agent Code Injection

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-73486

Flowise is a low-code platform for building LLM applications, which is commonly deployed as an internet-facing web application or API service to facilitate user interactions and external integrations.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Flowise's CSV Agent could allow attackers to run malicious code on systems running the platform. This issue arises from a bypass of security checks in how custom CSV data is processed, potentially leading to unauthorized execution within the application's environment. The main concern is confirming if this technology is in use and, if so, assessing the level of exposure.

Code can be injected via CSV data.
Affects systems building LLM applications.
Verify if this technology is in use.

Attack Path

How an attacker could exploit the issue

An authenticated attacker could exploit this vulnerability by providing specially crafted input to the CSV Agent node's customReadCSV parameter. This input can bypass the static regex blocklist through obfuscation, allowing the attacker to inject and execute arbitrary Python code within the unsandboxed pyodide environment, leading to full system access.

Authenticated access required.
Bypassed regex in CSV Agent.
Arbitrary code execution and system access.

Live Threat

Current exploitation, exposure, and threat context

Authenticated users could execute arbitrary Python code by bypassing the CSV Agent's input validation, leading to unauthorized system access and modification within the unsandboxed pyodide environment. This could affect any data or functionality accessible by the application's runtime.

System data and service behavior.
Code injection via CSV Agent parameter.
Arbitrary code execution with system access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the CSV Agent node of Flowise, which allows for arbitrary Python code execution, likely impacts teams responsible for application development, platform management, and security operations. The initial step is to identify all instances of the affected technology, confirm their business criticality and external reachability, and then assign an accountable owner to coordinate a risk-based remediation plan.

Application and platform teams own remediation.
Verify affected instances and reachability first.
Plan maintenance for targeted code updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Flowise?

Flowise is a low-code software platform designed for building applications powered by Large Language Models (LLMs). It provides a drag-and-drop interface for developers to create AI-driven workflows and integrations, often deployed as an internet-facing web application or API service.

How does CVE-2026-73486 work?

This vulnerability is a code injection flaw classified under CWE-94. It happens because the application's CSV Agent node uses a simple filter to block malicious commands, but that filter can be tricked using obfuscation techniques. This allows a user to sneak unauthorized Python commands past the security check and execute them directly on the underlying server.

Do I need to be an administrator to trigger this?

You do not need administrative rights, but you must have authenticated access to the Flowise instance. The vulnerability is triggered by providing specially crafted input to the 'customReadCSV' parameter. Simply using standard, non-malicious CSV data or accessing the application without submitting data to this specific node does not trigger the flaw.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal indicates a high likelihood of risk because Flowise is frequently deployed as an internet-facing application. If your instance is reachable from the public internet, it has a broader exposure surface compared to a private, internal-only implementation, making it more accessible to potential attackers.

What should I do to secure my Flowise environment?

Begin by identifying every instance of Flowise running in your environment. Once you have a complete inventory, verify which instances are exposed to the internet. Coordinate with your platform and application teams to plan a maintenance window for updating to a patched version that resolves the CSV Agent vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.