Flowise prior to version 3.1.3 contains a flaw in the CSVAgent that allows an attacker to insert arbitrary code into a Python source template. Because the template is executed by Pyodide with a JavaScript bridge that exposes eval and dynamic import, an injected payload can escape the quoted string and run arbitrary Node modules, leading to file I/O or OS command execution. The vulnerability arises from no validation of the csvFile data URI base64 segment. An attacker controlling a workspace user with chatflows:create or agentflows/chatflows update permission can create a CSV Agent node with a malicious csvFile. When that chatflow is triggered via an unauthenticated POST /api/v1/prediction/:id request, the host process is compromised, allowing remote code execution without authentication.

FlowiseAI Flowise applications running any version before 3.1.3 are affected. The issue exists in the CSVAgent component of Flowise and requires the application to run Pyodide on a Node.js environment where the default JavaScript bridge exposes eval and dynamic import.

The CVSS score of 9.4 indicates a critical severity. EPSS data is not available, so the exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by creating a malicious chatflow node under a workspace user with creation or update rights, then sending an unauthenticated POST /api/v1/prediction/:id request that triggers the vulnerable code path, resulting in remote code execution on the Flowise host.