Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified - CVE-2026-69255

Description

This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2.

Recommendation

Update the flowise-components package to the latest compatible version. Followings are version details:

Affected version(s): <= 3.1.2
Patched version(s): 3.1.3

References

GHSA-vmv7-4m6c-3cg5
CVE-2026-69255
CWE-94
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified and gives you actionable findings to investigate.

Start a free scan

Related Issues

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - flowise-components - CVE-2026-70477
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - CVE-2026-41264
Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability - CVE-2026-41265
DbGate: Remote Code Execution via functionName injection in loadReader endpoint - CVE-2026-48017

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

See something that needs correcting? Let us knowUpdated August 04, 2026