CVE-2026-69264 is a critical (CVSS 9.8) code injection in the Flowise CSV Agent, fixed in 3.1.3. A user who can edit chatflows could plant a crafted CSV Agent node, and once the flow is public, an unauthenticated request could run code on the host. The fix removed the CSV Agent.
What's affected
- Product: Flowise, the drag and drop builder for large language model flows (FlowiseAI).
- Affected versions: before 3.1.3.
- Fixed version: 3.1.3. The Flowise GitHub repository page shows that it was archived on 13 August 2026, so check where maintained releases come from before you plan the upgrade.
- What the advisory says: the CSVAgent put an attacker controlled part of the csvFile data URI into a Python source template that Pyodide then executed. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import, the attacker could break out and run file I/O or OS commands as the Flowise process. A workspace user with chatflows:create or update permission can plant a CSV Agent node, and once the chatflow is exposed through the prediction endpoint, any unauthenticated request triggers it.
- Weaknesses: CWE-94 code injection and CWE-95 eval injection.
- Severity: CVSS 3.1 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Check the installed Flowise version:
npm ls -g flowise
docker image ls | grep -i flowise
For a running instance, the version is shown in the application's settings or about page. Anything below 3.1.3 is in range. Then check which chatflows are reachable without authentication through the prediction endpoint, because that endpoint is the entry point for this CVE.
What to do now
- Find every Flowise instance, including test and demo servers.
- Upgrade to Flowise 3.1.3 or later.
- Check that Flowise is not reachable from the internet without authentication in front of it.
- List who holds permission to create or edit chatflows, and look for existing CSV Agent nodes.
- Review chatflows and agent flows for nodes or settings you did not create.
- Rotate API keys and credentials stored in Flowise if the instance was exposed.
Why it matters
Two conditions combine here. First, a user with permission to create or edit chatflows has to plant the malicious node. Second, the flow has to be reachable by the public prediction endpoint, after which any unauthenticated request triggers the code. The vector says no privileges because the final trigger is anonymous, but real exposure starts with who can edit flows.
The root cause is building code from data. The CSV file value went into a Python template, and the validators that exist for user code were never applied to that template. The Pyodide runtime also exposed a bridge to the Node.js process, which turned a sandboxed language into host access. The pull request that fixed it removed the CSV Agent and Airtable Agent components and the Pyodide dependency, which is a stronger remedy than patching the template. The CISA KEV flag is false and no exploitation is reported.
Quick check
Who can plant the malicious node?
A workspace user with permission to create chatflows or to update agentflows and chatflows, per the advisory text.
Do I lose the CSV Agent after upgrading?
The pull request title and description say the CSV Agent and Airtable Agent were removed. Check the release notes if you depend on them.
Sources
- GitHub security advisory GHSA-4j8x-x6v7-w9rq
- Fix pull request 6499
- Flowise release 3.1.3
- Gold record for CVE-2026-69264
Last reviewed: 19 October 2026.
