Flowise is a drag‑and‑drop interface for building large‑language‑model flows. A flaw in the run method of the CSV_Agents class before version 3.1.0 allows attacker‑generated Python scripts to be executed in the context of the user running the Flowise server. The problem arises from a lack of sandboxing when evaluating LLM‑generated code, giving the attacker the ability to have the server run arbitrary commands through prompt injection into a chatflow that uses the CSV Agent node. This vulnerability can compromise confidentiality, integrity, and availability if exploited.

All FlowiseAI Flowise installations prior to version 3.1.0 are affected. The flaw exists in the CSV Agent node and can be triggered by any chatflow that uses that node, regardless of the user’s authentication status.

The CVSS score for this issue is 9.2, indicating critical severity. The EPSS score is below 1%, suggesting a low likelihood of widespread exploitation at present, but the vulnerability is still listed as a remote code execution flaw, and it is not currently part of the CISA KEV catalog. An unauthenticated attacker can send crafted prompts to a chatflow using the CSV Agent node, potentially coaxing the LLM into generating malicious Python code that runs with server privileges. The attack can be performed from any network location that can reach the Flowise instance.