Description
Flowise’s CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis (which on Node.
Recommendation
Update the flowise-components package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.1.2
- Patched version(s): 3.1.3
References
Could your website be exposed too?
SmartScanner can check your website for Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise: Authenticated RCE Via MCP Adapters - CVE-2026-40933
- Flowise: Code Injection in CSVAgent leads to Authenticated RCE - CVE-2026-41137
- Flowise RCE via SQLite Record Manager Node - CVE-2026-69259
- Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override - CVE-2026-69254
You might also like:
See something that needs correcting? Let us knowUpdated August 04, 2026