Flowise before version 3.1.3 contains a sandbox escape flaw in the pythonCodeValidator component. The validator does not block native Pandas DataFrame methods such as to_csv, to_json, pipe, and query. Because the application accepts uploaded CSV data, an authenticated user can embed code that calls these methods, which allows the attacker to read the CSV contents or write arbitrary files to the server filesystem. The vulnerability corresponds to CWE‑184, describing data corruption by writing to an unexpected location. The primary impact is the potential for unauthorized data exfiltration or arbitrary file writes that may facilitate further compromise.

The vulnerability affects the Flowise product sold by FlowiseAI. Any installation running a Flowise version earlier than 3.1.3 is vulnerable. No other versions or variants were identified. Users should verify their current Flowise version before applying any remediation.

The CVSS score of 8.6 indicates a high severity. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread public exploits have been reported yet. However, the requirement for authenticated access means that compromised or delegated user credentials could be abused. The likely attack vector is an application‑level code injection performed by uploading a malicious CSV file. While the CVE description does not explicitly state that remote code execution is possible, the ability to write arbitrary files may enable subsequent exploitation. The risk of serious data exfiltration or server compromise warrants a timely response.