Flowise CSV Agent Prompt Injection Leads to Unauthenticated RCE (CVE-2026-70477)

What Happened

Trend Micro's Zero Day Initiative disclosed a vulnerability in Flowise, the open-source LLM workflow builder, tracked as CVE-2026-70477. According to the advisory, the flaw lives in the run method of the CSV_Agents class (packages/components/nodes/agents/CSVAgent/CSVAgent.ts). When a chatflow using the CSV Agent node processes a query, user-controlled input is embedded into a prompt sent to the configured LLM. The LLM's response is treated as executable Python and run inside an unsandboxed pyodide environment after passing through a static regex-based blocklist validator (validatePythonCodeForDataFrame).

ZDI reports that this blocklist can be bypassed with at least eight distinct techniques — including chr() encoding, string-concatenated identifiers, MRO/frame-object traversal, and df.query() expression evaluation — allowing a crafted LLM response to reach code execution. Because pyodide is not isolated from the host OS, any code that clears the validator runs with full access to host interfaces. The advisory states this can be triggered unauthenticated via prompt injection against an existing chatflow, or by an authenticated attacker who configures a chatflow to point at an attacker-controlled model server that returns a malicious payload directly, bypassing the LLM entirely. A public proof-of-concept (poc.py) with server, chatflow, and prompt-injection modes accompanies the disclosure. This was tested against Flowise 3.1.1; a patched version was not specified in the material reviewed.

Why It Matters

This is a remote code execution path that requires no authentication in the prompt-injection scenario — an attacker only needs the ability to send input to a chatflow exposing a CSV Agent node. Any organization running Flowise-based chatbots or agent workflows that ingest untrusted user input and use the CSV Agent node is potentially exposed to full compromise of the host running the service account. The blocklist-based validator being bypassable in eight distinct ways underscores that regex-based sanitization of LLM-generated code is not a reliable security boundary.

What Defenders Should Do Now

• Inventory Flowise deployments and identify any chatflows using the CSV Agent node, especially those exposed to untrusted or public input.
• Restrict or disable the CSV Agent node until a vendor fix is confirmed and applied; treat any LLM-generated code execution path as untrusted.
• Review outbound model configuration for chatflows — verify LLM endpoints are pinned to trusted providers, since an attacker who can redirect a chatflow to a malicious model server can bypass the LLM and validator entirely.
• Monitor process execution and outbound network activity from the Flowise service account/host for anomalous child processes, shell invocations, or unexpected outbound connections originating from the pyodide runtime.
• Audit logs for chatflow prediction requests containing unusual encoded strings (e.g., chr() sequences, concatenated dunder attributes like __import__, __builtins__, __subclasses__, __mro__) as a hunting signal for injection attempts.
• Apply least-privilege to the account running Flowise so that even a successful pyodide escape has limited host impact.

Developing Intel

This is a same-day advisory disclosure with a public proof-of-concept, and details — including a confirmed patched version — may evolve. df00tech will track this item and update guidance as more information becomes available. Full technical detail and the original disclosure are available from the GHSA advisory (GHSA-5xvg-pmgg-3mxr).