Flowise CSVAgent RCE via Pandas Pickle Deserialization Bypasses Denylist (CVE-2026-69256)

A newly published GitHub Security Advisory (GHSA-x6vm-w76m-8j7g) discloses a remote code execution vulnerability in Flowise's CSVAgent node, tracked as CVE-2026-69256 and affecting the flowise-components and flowise npm packages. The vulnerability lives in flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where a user-supplied customReadCSVFunc string is interpolated into Python code executed via pyodide. The code attempts to block dangerous input with a denylist of forbidden patterns (imports, eval, exec, os., subprocess., dunder attributes, etc.), but the list does not cover pandas' own read_pickle() function. Since pickle deserialization can trigger arbitrary code execution via a crafted __reduce__ method, an attacker can bypass the denylist entirely and achieve OS command execution. A public proof-of-concept is included in the advisory, demonstrating a full exploit chain from a base64-encoded pickle payload embedded in a CSV Agent node's "Additional Parameters" through to reverse shell execution triggered by a simple POST request to the chatflow's prediction API.

Why It Matters

Flowise is a widely used low-code platform for building LLM-powered chatflows, and the CSVAgent node is a common building block for CSV/data-analysis workflows. Because the exploit only requires the ability to configure a chatflow node (not raw code execution privileges) and is triggered via an unauthenticated-looking POST to /api/v1/prediction/<chatflowUUID>, any Flowise deployment that allows untrusted users to create or modify chatflows with a CSV Agent node — or that exposes prediction endpoints without adequate access control — is at risk of full RCE on the host running Flowise. This is a textbook sandbox-escape/denylist-bypass pattern that defenders should treat as high severity given the public PoC and exploit status.

What Defenders Should Watch For

• Inventory any self-hosted Flowise instances and check whether they run affected versions of flowise-components/flowise; monitor the advisory for a patched release.
• Review who can create/edit chatflows and restrict CSV Agent node usage or chatflow authoring to trusted users until patched.
• Hunt for anomalous outbound connections, reverse shells, or unexpected child processes spawned from the Flowise host/container, particularly around pyodide execution paths.
• Watch for suspicious POST requests to /api/v1/prediction/* endpoints, especially payloads containing base64-encoded blobs or references to pd.read_pickle.
• Consider network egress restrictions and container hardening (least privilege, no shell access) around any service that executes user-influenced code, as defense-in-depth against denylist bypasses like this one.

This is developing, net-new intelligence based solely on the GitHub Security Advisory published today; no vendor patch details, exploitation-in-the-wild reports, or CVSS score were available in the source at the time of writing. For full technical details and the proof-of-concept, see the original advisory: GHSA-x6vm-w76m-8j7g.