CVE-2026-70477 is a critical (CVSS 9.8) prompt injection flaw in the CSV Agent node of Flowise. A crafted prompt can make the model return Python that passes a blocklist check and then runs. It affects versions through 3.1.2 and is fixed in 3.1.3.
What's affected
Flowise before 3.1.3. The GitHub advisory lists the flowise and flowise-components npm packages at version 3.1.2 and below, with 3.1.3 as the patched release.
The flaw sits in the run method of the CSV Agent class. Chatflows that do not use the CSV Agent node do not reach this code. The advisory is a report from Trend Micro's Zero Day Initiative and says authentication is not required to reach the vulnerable behavior, so a public chatflow is the main exposure.
How to check if you're exposed
Check the installed version.
npm ls flowise flowise-components
For containers, look at the image tag you deployed. Then list your chatflows and note any that use a CSV Agent node, especially flows that are open to unauthenticated users or embedded in a public site.
What to do now
- Upgrade flowise and flowise-components to 3.1.3 or later.
- Find chatflows that use the CSV Agent node and decide whether they need to stay public.
- Require authentication in front of the Flowise API and chat endpoints where you can.
- Run the service with minimal operating system privileges and limited access to secrets.
- Review recent chat logs for odd prompts to agent flows.
Why it matters
The record maps this to CWE-94, code injection. The design runs the model's output as code. The model builds its answer from a prompt that includes user text, so anyone who can talk to the chatflow can try to steer what comes back.
The check that sits between the model and the interpreter is a blocklist, and the advisory shows it can be bypassed. Treat any LLM output that gets executed as untrusted input, no different from a form field. Related Flowise issues in this release, such as CVE-2026-70470 and CVE-2026-73487, hit the same validator from different angles.
The record's KEV flag is false and nothing in it describes exploitation in the wild.
Quick check
Is this the same bug as CVE-2026-70470?
No. Both involve the same validator and the same fix release, but this one is about prompt injection producing code, and the other is about look-alike characters getting past the pattern list.
Sources
Last reviewed: 19 October 2026.
