Critical Flowise CSVAgent RCE: Attacker-Controlled Base64 Data Interpolated Into Python, Escapes Pyodide via JS Bridge

GitHub Security Advisory GHSA-4j8x-x6v7-w9rq (CVE-2026-69264), published August 4, 2026, discloses a critical remote code execution vulnerability in Flowise, an open-source low-code platform for building LLM agent workflows.

What Was Reported

According to the advisory, Flowise's CSVAgent node extracts a segment of the attacker-controlled csvFile data URI and interpolates it directly into a Python source-code template that is executed via Pyodide (a WASM-based Python runtime). Because Pyodide on Node.js is loaded with its default js bridge to globalThis, an attacker can break out of the Python string literal, invoke js.eval, and dynamically import() Node built-in modules such as fs or child_process — executing arbitrary file I/O or OS commands as the Flowise host process, not inside the intended sandbox. The advisory states two existing validator functions in the codebase are never applied to this particular code path. The reporter includes a working proof-of-concept verified against a stock [email protected] install on Node 20.20.2, and rates the issue CVSS 9.9 (Critical).

Why It Matters

Per the advisory, triggering the exploit requires a workspace user with chatflow create/update permissions to plant a malicious CSVAgent chatflow once; after that, any unauthenticated request to the whitelisted POST /api/v1/prediction/:id endpoint can trigger full host compromise — since apikeyid is unset by default on new chatflows. In OSS deployments, the advisory notes any registered user typically has the required permissions, lowering the bar significantly. Successful exploitation reportedly yields arbitrary OS command execution as the Flowise process, exposing encrypted credential stores, the application database, the host filesystem, and any network resource reachable from the host. At time of writing, the advisory describes the issue as unpatched at the audited commit.

What Defenders Should Watch For

• Inventory any self-hosted Flowise instances and check for CSVAgent nodes in existing chatflows, particularly any exposed via public prediction endpoints without an API key configured.
• Review who holds chatflows:create, chatflows:update, agentflows:create, and agentflows:update permissions, and restrict these to trusted users until a fix ships.
• Ensure apikeyid is set on all chatflows that use CSVAgent so prediction requests require authentication.
• Monitor Flowise process logs and host-level EDR for unexpected child processes, file writes, or outbound connections originating from the Node.js process backing Flowise — especially around /api/v1/prediction/ calls.
• Where feasible, strip csvFile from any nodeOverrides allow-list so it cannot be supplied at prediction time.
• Watch for pandas-related errors (e.g., EmptyDataError) in chat responses combined with unexplained host-level activity, which the advisory notes can be a symptom of a failed/partial exploitation attempt.

Developing Intel

This is fresh, net-new intel from a GitHub Security Advisory published today with a public proof-of-concept and no confirmed patched version as of this writing. Details, affected version ranges, and remediation status may change — consult the original advisory for the latest information: GHSA-4j8x-x6v7-w9rq.