A flaw in the CSV Agent node of Flowise, a drag‑and‑drop LLM designer, allows an attacker to inject a specially crafted prompt. The untrusted content is incorporated directly into an LLM prompt, causing the model to produce a malicious Python script. The script bypasses the blocklist validator and runs in an unsandboxed Pyodide environment, enabling arbitrary code execution under the service account. This is a classic example of a code injection weakness (CWE‑94).

The vulnerability affects all installations of Flowise version 3.1.3 and earlier. Users should consult the Flowise release notes to verify that they are not running a vulnerable version.

The CVSS score of 9.5 marks this issue as Critical, indicating high impact and ease of exploitation. EPSS information is not available, so the current exploitation probability cannot be quantified, but the absence of a KEV listing means no confirmed active exploitation is known. Attackers would require network access to the Flowise service and the ability to submit prompts to a chatflow that includes a CSV Agent node. Once the prompt is delivered, the LLM response triggers unsandboxed execution of the attacker‑supplied Python code, giving full control over the service environment.