The flaw is a code injection vulnerability in the CSV Agent node’s customReadCSV parameter of Flowise versions prior to 3.1.3. A malicious authenticated user can supply input that bypasses a static regex blocklist through obfuscation, allowing arbitrary Python code to run inside the unsandboxed Pyodide environment. The injected code runs with full system privileges, leading to a complete loss of confidentiality, integrity, and availability. The weakness corresponds to CWE‑94: Improper Control of Generation of Code. The primary impact is Remote Code Execution, which can be used to compromise the host system.

FlowiseAI’s Flowise product running any version before 3.1.3 is affected. Versions 3.1.3 and later contain a patch that removes the vulnerable code path. The vulnerability exists in the CSV Agent node across all operating systems where Flowise is installed, although this operating‑system scope is inferred and not explicitly confirmed in the advisory.

The CVSS score of 9 indicates a critical severity and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild yet. The EPSS score is not available, so the likelihood of exploitation cannot be quantified. The attack requires authentication to create or modify a Flowise CSV Agent flow, implying that compromised or privileged users can trigger the injection. Once bypassed, code runs with full system access inside Pyodide, making exploitation highly effective and damaging.