CVE-2026-73486: Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV
Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to execute code in the unsandboxed pyodide environment with full system access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 3.1.3 - Compensating control
Ensure only trusted/authorized users can access the Flowise CSV Agent node, since the vulnerability can be exploited by authenticated attackers to execute arbitrary Python code.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73486?
The severity of CVE-2026-73486 is rated at 77, indicating a high risk for exploitation.
How do I fix CVE-2026-73486?
To fix CVE-2026-73486, update Flowise to version 3.1.3 or later, which addresses the code injection vulnerability.
What types of attacks can CVE-2026-73486 facilitate?
CVE-2026-73486 can facilitate attacks that allow authenticated users to execute arbitrary Python code on vulnerable systems.
Who is affected by CVE-2026-73486?
Users running versions of Flowise prior to 3.1.3 are affected by CVE-2026-73486 and should take immediate action.
What is the impact of exploiting CVE-2026-73486?
Exploiting CVE-2026-73486 can lead to unauthorized execution of code, which may compromise the integrity and security of the system.