CVE-2026-69256: High Pickle Deserialization RCE in Flowise CSVAgent

CVE-2026-69256 is a high severity (CVSS 8.8) code injection flaw in Flowise. Before 3.1.3, the CSVAgent let users supply Python run through Pyodide, and a pickle read path evades the denylist, so a user who can edit a chatflow can run commands. Upgrade to Flowise 3.1.3.

What's affected

The record says Flowise before 3.1.3 is affected, and that the issue is fixed in 3.1.3. Fixed in Flowise 3.1.3, which the project published as a GitHub release. The release page I retrieved shows the repository as archived and read only by its owner since 13 August 2026. That does not change the advice to run 3.1.3 or later, but it does mean you should check where future security fixes will come from before you rely on this project long term.

The record says the CSVAgent node let users provide Python through a customReadCSVFunc parameter, evaluated as a pandas call. A denylist blocked dangerous constructs, but pandas read_pickle can deserialize a payload and run code without matching a denied word. The record says an authenticated user who can create or modify a chatflow can place the payload in the Additional Parameters, save the flow and trigger the prediction endpoint.

I relied on the record for the technical description of this CVE. The 3.1.3 release page was the only vendor page I retrieved, and it does not give a per-CVE explanation.

How to check if you're exposed

npm ls -g flowise
docker image ls | grep -i flowise

The first command shows a global npm install, the second any Flowise container image and its tag. If you run it from a compose file or a Kubernetes manifest, read the image tag there. Anything below 3.1.3 is in scope.

Then find who can reach the affected feature. In most deployments the first control is who holds a login or an API key, so list those too. Every path described in the record needs some level of access, or in the unauthenticated case, only network reach to the service.

A quicker route for a whole project is the free in-browser dependency scan at Gold. Paste a manifest or lockfile and it matches each dependency against known CVEs, including ones pulled in indirectly.

What to do now

1. Upgrade Flowise to 3.1.3 or later and redeploy all instances, including containers built from older images.
2. Limit chatflow create and edit rights to trusted users.
3. Search saved flows for CSV Agent nodes with custom read function parameters you do not recognise.
4. Run Flowise in a container as a non-root user with no access to secrets it does not need.
5. Treat the earlier CSVAgent CVE-2026-69255 as part of the same upgrade.
6. Check whether the project's archived status affects your support plan, and decide on an owner for security updates.
7. Run Flowise behind authentication and a network boundary, and do not expose its admin or API ports directly to the internet.

Reachability analysis helps with ordering the work. Knowing whether your code actually calls the affected path tells you which services to patch first.

Why it matters

The class is CWE-94, improper control of generated code, and it involves unsafe deserialization too. Pickle is a format that can run code as it loads, which is why loading untrusted pickles is unsafe in any language runtime.

This is also a second CSVAgent problem alongside CVE-2026-69255. Fixing one injection point does not clear the node, which is why the 3.1.3 release matters for both. The record does not mark this CVE as known exploited. Limiting who can edit chatflows is the most useful operational control.

Quick check

Sources

• https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3
• Record: NVD entry for CVE-2026-69256 (score 8.8, HIGH)

Last reviewed: 18 October 2026.