The CSVAgent node in Flowise allows authenticated users to embed arbitrary Python code that is executed via pyodide. A permissive denylist blocks many dangerous constructs but fails to guard against pandas.read_pickle(), enabling the deserialization of a malicious pickle payload and execution of arbitrary code. An attacker who can create or edit a chatflow can inject a malicious read_pickle command into the Additional Parameters field, save the flow, and later trigger the /api/v1/prediction/<UUID> endpoint to run the payload on the host system.

All Flowise installations of FlowiseAI:Flowise prior to version 3.1.3 are vulnerable. The flaw exists in the CSVAgent component where the customReadCSVFunc user input is evaluated as pd.{customReadCSVFunc} within flowise-components/nodes/agents/CSVAgent/CSVAgent.ts. This includes every release before the 3.1.3 hotfix which removes the denial mechanism for read_pickle.

With a CVSS score of 9.4 the vulnerability is considered Critical. An exploit requires an authenticated user with permission to create or modify chatflows; once the malicious flow is saved, an exploit can be triggered by any request to /api/v1/prediction/<UUID>. The EPSS score is not available, and the vulnerability is not yet listed in CISA’s KEV catalog, but the high impact and authentication requirement make it a priority for remediation.