Flowise CSV Agent Flaw Now Confirmed for Root RCE via Pyodide Sandbox Escape

A previously reported code-injection issue in Flowise's CSV Agent has been confirmed as a full remote code execution vulnerability, according to a GitHub Security Advisory (GHSA-vmv7-4m6c-3cg5, tracked as CVE-2026-69255). The researcher (S9S Bounty-LAB / Kamal Sentassi) reports building a working Metasploit module and obtaining a Meterpreter session with uid=0(root) against Flowise 3.1.2.

What was reported

Per the advisory, the vulnerability originates in packages/components/nodes/agents/CSVAgent/CSVAgent.ts, where a base64-encoded string is interpolated directly into a Python code string (base64_string = "${base64String}") that is executed inside a Pyodide (WebAssembly Python) sandbox. Because the value isn't validated or escaped before interpolation, an attacker-supplied payload can break out of the string literal and inject arbitrary Python. The advisory states that Pyodide's js bridge exposes the host Node.js process, allowing the injected code to reach process.mainModule.constructor._load('child_process') and call execSync() — executing OS commands outside the sandbox entirely. The report also notes a validation function (validatePythonCodeForDataFrame()) exists but is only applied to later LLM-generated code, not to this initial injection point. Related CVEs cited in the advisory (CVE-2026-41264, CVE-2026-41265, CVE-2026-46442) suggest a pattern of sandbox-escape issues across multiple Flowise agent nodes.

Why it matters

If accurate, this is a critical-severity issue: the advisory claims exploitation as root inside the container, plus arbitrary file read and credential exposure (including example env-style values like FLOWISE_PASSWORD and database/API-key paths) and the ability to crash the Node.js process outright. Flowise is a widely used low-code LLM/agent-orchestration platform, so any deployment exposing the CSV Agent node to untrusted input or unauthenticated/lightly-authenticated users is at risk of full host or container compromise, not just data-processing abuse. A public advisory with a reported working exploit chain also raises the likelihood of near-term opportunistic scanning and exploitation attempts.

What defenders should do now

• Identify any Flowise instances in your environment, especially those exposing chatflow creation or CSV Agent functionality to external or low-trust users.
• Review authentication and network exposure for Flowise admin/API endpoints — the advisory's exploit chain requires authenticated access to create a chatflow.
• Monitor for anomalous child-process spawning or shell execution originating from the Flowise Node.js process, and for unexpected outbound connections from Flowise hosts/containers (potential reverse-shell activity).
• Watch for unusual file-read attempts on sensitive paths (e.g., configuration, credential, or database files) originating from the Flowise application process.
• Restrict container privileges — the advisory notes the process runs as root/PID 1 in the observed environment, so running Flowise as a non-root user and applying standard container-hardening practices would reduce blast radius even if the code-injection issue is not yet patched.
• Track upstream Flowise releases/patches for CSV Agent and related agent nodes referenced in the advisory (Airtable Agent, NodeVM).

Developing intel

This write-up is based on a single GitHub Security Advisory that includes researcher-provided proof-of-concept details and claims of a working Metasploit module; df00tech has not independently verified the exploit chain. Treat specifics (exact payloads, credential values, and impact claims) as unverified until confirmed by the vendor or additional independent analysis. For full technical details, see the original advisory: GHSA-vmv7-4m6c-3cg5.