CVE-2026-41264 is a critical remote code execution flaw (CVSS 9.8) in the Flowise CSV Agent node. Versions up to 3.0.13 run an LLM generated Python script without a sandbox, so prompt injection can reach the server. Fixed in 3.1.0.
What's affected
Per the GitHub advisory, the npm packages flowise and flowise-components at 3.0.13 and earlier are affected. Version 3.1.0 is patched.
Only flows that use the CSV Agent node reach the vulnerable code. The advisory text, which reproduces a Zero Day Initiative report (ZDI-CAN-29411), says authentication is not required to exploit it when an attacker can send prompts to such a chatflow.
How to check if you're exposed
Check the Flowise version in your deployment:
npm ls flowise flowise-components
For Docker or other container installs, check the image tag you run against 3.1.0. Then list your chatflows and find any that use the CSV Agent node. A flow with that node that is open to the public, or to many users, is the highest risk. Use the free dependency scan for repositories that pin Flowise.
What to do now
- Upgrade Flowise to 3.1.0 or later and redeploy.
- Until then, remove or disable chatflows that use the CSV Agent node, or restrict who can send prompts to them.
- Run Flowise as an unprivileged user with limited network and file access, so a bad run reaches less.
- Review server logs and processes for anything unexpected on instances that were exposed.
Why it matters
The NVD record lists CWE-184, incomplete list of disallowed inputs. The advisory says the root problem is the lack of proper sandboxing when evaluating a Python script that an LLM wrote. The model's output is treated as trusted code, but the model's input can come from anyone who can type into the chat box.
That is the core risk of agent tools that execute generated code. Prompt injection means the attacker does not need to touch the server, only the conversation. Treat generated code as untrusted, run it in an isolated sandbox, and limit who can reach the agent. The record does not flag this CVE as known exploited.
Quick check
Do I need to be logged in to Flowise to exploit it?
The advisory says authentication is not required, assuming the attacker can send prompts to a chatflow with the CSV Agent node. Whether that is possible depends on how you exposed the flow.
Sources
Last reviewed: 19 October 2026.
