Flowise CSVAgent: Pickle Deserialization via pandas.read_pickle() Enables Remote Code Execution (CVE-2026-69256)

A newly published GitHub Security Advisory (GHSA-x6vm-w76m-8j7g) discloses a remote code execution vulnerability in Flowise, an open-source low-code LLM/agent-building platform, tracked as CVE-2026-69256 and affecting the flowise-components and flowise npm packages. A public proof-of-concept is available.

What Happened

The CSVAgent node lets users supply Python code (via a customReadCSVFunc parameter) that is executed inside a pyodide sandbox to process CSV data with pandas. Flowise applies a denylist blocking dangerous constructs such as import, eval(), exec(), os., subprocess., and various reflection/dunder attributes. However, the denylist does not cover pandas.read_pickle(), which deserializes attacker-supplied pickle data. Because Python pickle deserialization can invoke arbitrary callables via __reduce__, an attacker can craft a payload that executes OS commands (e.g., spawning a reverse shell) without using any denylisted keyword. The advisory includes a working PoC: a custom in-memory file-like object (to avoid needing import or open()) feeds a base64-decoded pickle payload to pd.read_pickle(), which is then triggered via a POST request to the chatflow's prediction API endpoint.

Why It Matters

This is a denylist-based sandbox escape — a class of vulnerability that is inherently fragile because it must anticipate every dangerous primitive rather than restrict to a safe allowlist. Any Flowise deployment exposing the CSVAgent node to untrusted or semi-trusted users (a common pattern in self-hosted or multi-tenant LLM workflow platforms) is at risk of full remote code execution on the host running the chatflow, with impact scoped to whatever privileges the Flowise service process holds.

What Defenders Should Do Now

• Identify any Flowise instances in your environment and check whether the CSVAgent node is in use or exposed to untrusted input.
• Watch for anomalous outbound connections or child-process spawns (e.g., shell/netcat invocations) originating from the Flowise/pyodide process, as well as unexpected calls into prediction API endpoints followed by suspicious process activity.
• Treat code-execution sandboxes built on denylists as inherently bypassable; where feasible, isolate Flowise chatflow execution in a hardened container or VM with no network egress and minimal host privileges, independent of any application-layer fix.
• Review access controls on chatflow creation/editing and the prediction API to ensure only trusted users can define or trigger CSVAgent logic.

This is developing, same-day intel and details may be refined as the vendor and community respond. No fix version or patch status is specified in the advisory as reviewed here — track the original source for updates: GHSA-x6vm-w76m-8j7g.