Description
Flowise <= 3.1.2 CSV Agent and Airtable Agent nodes use a regex-based blocklist (validatePythonCodeForDataFrame()) to sanitize LLM-generated Python code before execution in Pyodide.
Recommendation
Update the flowise-components package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.1.2
- Patched version(s): 3.1.3
References
Could your website be exposed too?
SmartScanner can check your website for Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - flowise-components - CVE-2026-70477
- Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified - CVE-2026-69255
- Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - CVE-2026-41264
- Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE - CVE-2026-70470
You might also like:
See something that needs correcting? Let us knowUpdated October 07, 2026