Flowise, a drag‑and‑drop interface for building large‑language‑model workflows, contains a flaw in its CSVAgent component that allows an attacker to inject arbitrary Python code. The vulnerability arises because the agent interpolates a base64 string from user‑supplied CSV data directly into executable code without proper validation. Once the malicious code is executed within Pyodide, it can load the Node.js child_process module via Pyodide’s JavaScript bridge and run arbitrary operating system commands with root privileges inside the Flowise container. This code‑injection weakness (CWE‑94) gives the attacker full control over the affected system, enabling data exfiltration, persistence, and lateral movement.

Flowise by FlowiseAI is impacted. All installations running Flowise 3.1.2 or earlier are vulnerable because they lack the patch that sanitizes the CSV input. The vulnerability resides specifically in the CSVAgent code located under packages/components/nodes/agents/CSVAgent/CSVAgent.ts. Deployments using Flowise 3.1.3 or later are considered safe after the fix.

The CVSS score of 9.2 denotes a critical severity. An authenticated attacker must be able to supply CSV input to the agent; no additional exploitation steps are required beyond providing manipulated data. The EPSS score is not provided, so the current likelihood of exploitation is unknown, but the absence of a KEV listing suggests the vulnerability is newly discovered and may be actively exploited. The attacker’s ability to gain a root shell inside the container makes this a high‑risk vulnerability for any exposed Flowise deployment.